Marcus Johansson

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.1.10 Drupal AI versions 1.2.0 through 1.2.11 **Description** An incorrect authorization issue exists in Drupal AI (Artificial Intelligence) that allows for resource injection. The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) allow the use of a Large Language Model (LLM) to generate HTML or Markdown, and preview it in a browser. Under specific conditions, rendering this HTML can expose secret communications related to the LLM request. **Recommendations** Update Drupal AI to version 1.1.11 or later. Update Drupal AI to version 1.2.12 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.0.6 Drupal AI versions 1.1.0 through 1.1.6 Drupal AI versions 1.2.0 through 1.2.3 **Description** A flaw exists in Drupal AI that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Drupal AI to version 1.0.7 or later. Update Drupal AI to version 1.1.7 or later. Update Drupal AI to version 1.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 1.0.0 through 1.0.1 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform actions on a user's behalf without their consent. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions 1.0.0 through 1.0.1, update to version 1.0.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 0.0.0 through 1.0.2 **Description** The issue is related to a Missing Authorization vulnerability, which allows Forceful Browsing in Drupal AI (Artificial Intelligence). **Recommendations** For versions 0.0.0 through 1.0.2, update to version 1.0.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 0.0.0 through 1.0.4 **Description** The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command Injection. **Recommendations** For versions 0.0.0 through 1.0.4, update to version 1.0.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal AI (Artificial Intelligence) versions 0.0.0 through 1.0.4 **Description** The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command Injection. **Recommendations** For versions 0.0.0 through 1.0.4, update to version 1.0.5 or later to resolve the issue.