CVE-2026-84911 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Artificial Intelligence

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-119

History

Thu, 22 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal artificial Intelligence
Vendors & Products		Drupal Drupal artificial Intelligence

Thu, 22 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
Title		AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2026-119

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-22T01:22:17.746Z

Updated: 2026-10-22T13:48:23.369Z

Reserved: 2026-09-02T15:44:19.096Z

Link: CVE-2026-84911

Vulnrichment

Updated: 2026-10-22T13:48:17.721Z

NVD

Status : Awaiting Analysis

Published: 2026-10-22T02:17:01.490

Modified: 2026-10-22T16:54:17.390

Link: CVE-2026-84911

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84911", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-09-02T15:44:19.096Z", "datePublished": "2026-10-22T01:22:17.746Z", "dateUpdated": "2026-10-22T13:48:23.369Z"}, "containers": {"cna": {"title": "AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119", "datePublic": "2026-09-02T16:26:41.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-119"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/ai", "product": "AI (Artificial Intelligence)", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/ai", "versions": [{"lessThan": "1.3.13", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "1.4.8", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8."}], "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Artem Dmitriiev (a.dmitriiev)"}, {"lang": "en", "type": "remediation developer", "value": "Marcus Johansson (marcus_johansson)"}, {"lang": "en", "type": "remediation developer", "value": "Valery Lourie (valthebald)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:22:17.746Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T13:48:20.595226Z", "id": "CVE-2026-84911", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T13:48:23.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-84911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-22T13:48:20.595226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T13:48:17.721Z"}}], "cna": {"title": "AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119", "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Artem Dmitriiev (a.dmitriiev)"}, {"lang": "en", "type": "remediation developer", "value": "Marcus Johansson (marcus_johansson)"}, {"lang": "en", "type": "remediation developer", "value": "Valery Lourie (valthebald)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/ai", "vendor": "Drupal", "product": "AI (Artificial Intelligence)", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.3.13", "versionType": "semver"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.8", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/ai"}], "datePublic": "2026-09-02T16:26:41.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-119"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-22T01:22:17.746Z"}}}, "cveMetadata": {"cveId": "CVE-2026-84911", "state": "PUBLISHED", "dateUpdated": "2026-10-22T13:48:23.369Z", "dateReserved": "2026-09-02T15:44:19.096Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-22T01:22:17.746Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}