The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn'... (CVE-2026-118553)

Package: drupal/ai
Fixed in: 1.4.11, 1.5.2
Published: Wed 28 Oct 2026, 17:10 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon

In plain words

The AI module's AI Automator submodule can automatically fill fields using AI based on other fields. It does not sufficiently check access to text formats, allowing users to author field data in formats they should not be allowed to use.

Am I affected?

Look for drupal/ai and its installed version in composer.lock, then check whether your project uses the AI Automator submodule. The advisory lists fixes in 1.4.11 and 1.5.2 but gives no affected version range. Review access to text formats for fields handled by AI Automator, as the flaw concerns users authoring data in formats they should not have access to.

What to do

Check which version you have, then update to a fixed release for your branch (1.4.11, 1.5.2):

composer show drupal/ai | grep versions
composer update drupal/ai

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields.

The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.