**Update 2026-09-11:** Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into...

An attacker can cause SQL injection because the module does not sufficiently sanitise filter values before building database queries. This requires a Search API AI Search index using the module's Postgres/pgvector backend, with a non-string field exposed as a filter that the attacker can reach, for example through a View.

Look for drupal/ai_provider_amazeeio and its version in composer.lock. The advisory gives no affected version range, but lists 1.3.7 and 1.4.3 as fixed versions. Check whether a Search API AI Search index uses the module's Postgres/pgvector backend and exposes any non-string field as an attacker-reachable filter, for example through a View.

Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits.

This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search.

The module doesn't sufficiently sanitize filter values before using them to build SQL queries in its Postgres/pgvector backend, allowing SQL injection.

This vulnerability is mitigated by the fact that a site must be using the module's Postgres/pgvector vector database backend for a Search API AI Search index, and must expose one of that index's non-string fields as a filter (for example, through a View) that is reachable by the attacker.