Executive brief
Drupal AI Vulnerable to OS Command Injection via Optional Automator Types
Affected products
- Packagist drupal/ai
- packagist:https://packages.drupal.org/8 drupal/ai
Junglewise Threat Intelligence
CVE-2025-31692: Drupal AI Vulnerable to OS Command Injection via Optional Automator Types
CVE-2025-31692 · Severity: medium · CVSS 4 · Published 2025-04-01
Technologies: drupal/ai (Packagist), Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai. Vendors: Packagist, Packagist:Https://Packages.Drupal.Org/8.
Related threats
- Drupal AI module access bypass in translation
- Drupal AI module cross-site scripting in legacy agent setup
- Drupal AI missing authorization in agent tools
- Drupal AI module cross-site scripting and information disclosure
- DRUPAL-CONTRIB-2026-028 - The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM t