PatchClock

PHP security digest · Packages

drupal/ai security advisories

8 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Not rated 28 Oct 2026

    The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn'...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118553

  2. Not rated 28 Oct 2026

    This module provides a framework for integrating AI providers and features into Drupal. The module doesn't sufficiently sanitize certain HTMX attributes, which...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118552

  3. Not rated 28 Oct 2026

    This module provides a framework for integrating AI providers and features into Drupal. Audio for every speech-to-text request is written to the same file in t...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118551

  4. Not rated 28 Oct 2026

    This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118550

  5. Not rated 28 Oct 2026

    This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appe...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118549

  6. Not rated 28 Oct 2026

    This module enables you to use AI on the website. It also enables you to interact with AI providers. The module does not sufficiently validate links under cert...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118548

  7. Not rated 28 Oct 2026

    This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot. Under certain configurations, the chatbot...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118546

  8. Not rated 28 Oct 2026

    This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cross-site scripting (XSS) under certain c...

    Fixed in 1.4.11, 1.5.2 · CVE-2026-118545

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including drupal/ai, and the version that fixes it.