Executive brief
The AI SEO/GEO Analyzer module for Drupal, which uses artificial intelligence to provide search engine optimization reports, contains a security flaw. An attacker could plant malicious text in website content or comments that tricks the AI into generating harmful code. When a site administrator or content manager views the resulting AI report, this code could execute in their browser, potentially allowing the attacker to perform actions on their behalf or access sensitive information.
Technical details
The AI SEO/GEO Analyzer module fails to properly sanitize HTML output generated from Large Language Model (LLM) responses. The module sends entity content and comments to an LLM, converts the resulting Markdown to HTML, and stores it without passing it through Drupal's standard filtering pipeline. An attacker can exploit this by using prompt injection within content or comments to force the LLM to return malicious markup. When a user with permission to view SEO/GEO reports accesses the stored analysis, the injected script executes in their browser context. The vulnerability is fixed in version 1.1.3.
Affected products
- Drupal AI SEO/GEO Analyzer 0.0.0 to 1.1.2
Timeline
- 2026-07-08: patched: Version 1.1.3 released
- 2026-07-08: advisory: Drupal Security Advisory SA-CONTRIB-2026-076 published
- 2026-07-10: disclosed: CVE-2026-15085 published to NVD