Abhisek Mazumdar

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module and specific submodules, including AI Automators, AI Translate, AI API Explorer, and AI Content Suggestions, enable the use of a Large Language Model (LLM) to generate HTML or Markdown for browser preview. Under certain conditions, rendering this HTML can lead to XSS or the exposure of secret communications within the context of the LLM request. This issue requires an attacker to be able to inject text into prompts to execute the attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.1.10 Drupal AI versions 1.2.0 through 1.2.11 **Description** An incorrect authorization issue exists in Drupal AI (Artificial Intelligence) that allows for resource injection. The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) allow the use of a Large Language Model (LLM) to generate HTML or Markdown, and preview it in a browser. Under specific conditions, rendering this HTML can expose secret communications related to the LLM request. **Recommendations** Update Drupal AI to version 1.1.11 or later. Update Drupal AI to version 1.2.12 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic (affected versions not specified) **Description** The issue is related to the segment cloning functionality in Mautic, allowing any authenticated user to clone segments without proper authorization checks due to a missing authorization vulnerability in the cloneAction of the segment management. This enables an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones. **Recommendations** Update Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php, ensuring that users attempting to clone segments possess the appropriate creation permissions.