Executive brief
Drupal AI Cross-Site Request Forgery (CSRF) vulnerability
Affected products
- Packagist drupal/ai
- packagist:https://packages.drupal.org/8 drupal/ai
Junglewise Threat Intelligence
CVE-2025-31677: Drupal AI Cross-Site Request Forgery (CSRF) vulnerability
CVE-2025-31677 · Severity: low · CVSS 3.1 · Published 2025-04-01
Technologies: drupal/ai (Packagist), Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai. Vendors: Packagist, Packagist:Https://Packages.Drupal.Org/8.
Related threats
- Drupal AI module access bypass in translation
- Drupal AI module cross-site scripting in legacy agent setup
- Drupal AI missing authorization in agent tools
- Drupal AI module cross-site scripting and information disclosure
- DRUPAL-CONTRIB-2026-028 - The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM t