# Packagist:Https://Packages.drupal.org/8 Drupal/Ai vulnerabilities Source: https://junglewise.ai/threats/technologies/drupal-ai Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/drupal-ai.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in Packagist:Https://Packages.drupal.org/8 Drupal/Ai: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118553, was published on 30 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 10 - Last 90 days: 10 - All time: 18 (0 critical, 0 exploited in the wild) ## About Packagist:Https://Packages.drupal.org/8 Drupal/Ai Drupal module providing artificial intelligence integration and functionality. ## Latest Packagist:Https://Packages.drupal.org/8 Drupal/Ai vulnerabilities - [CVE-2026-118553: Drupal AI Automator text format access bypass](https://junglewise.ai/threats/cve-2026-118553-drupal-contrib-2026-273-the-ai-module-includes-a-submodule-ai) (info, published 30 Oct 2026) - [CVE-2026-118552: Drupal AI module cross-site scripting in HTMX attributes](https://junglewise.ai/threats/cve-2026-118552-drupal-contrib-2026-272-this-module-provides-a-framework-for) (info, published 30 Oct 2026) - [CVE-2026-118551: Drupal AI module information disclosure in speech-to-text audio](https://junglewise.ai/threats/cve-2026-118551-drupal-contrib-2026-271-this-module-provides-a-framework-for) (info, published 30 Oct 2026) - [CVE-2026-118550: Drupal AI module information disclosure in Search API caching](https://junglewise.ai/threats/cve-2026-118550-drupal-contrib-2026-270-this-module-provides-a-framework-for) (info, published 30 Oct 2026) - [CVE-2026-118549: Drupal AI module insufficient Markdown link validation XSS](https://junglewise.ai/threats/cve-2026-118549-drupal-contrib-2026-269-this-ai-module-enables-you-to-interact) (info, published 30 Oct 2026) - [CVE-2026-118548: Drupal AI module insufficient link validation](https://junglewise.ai/threats/cve-2026-118548-drupal-contrib-2026-268-this-module-enables-you-to-use-ai-on-the) (info, published 30 Oct 2026) - [CVE-2026-118546: Drupal AI module cross-site scripting in chatbot](https://junglewise.ai/threats/cve-2026-118546-drupal-contrib-2026-267-this-module-enables-you-to-use-ai-on-the) (info, published 30 Oct 2026) - [CVE-2026-118545: Drupal AI module cross-site scripting in HTML rendering](https://junglewise.ai/threats/cve-2026-118545-drupal-contrib-2026-266-this-module-enables-you-to-use-ai-on-the) (info, published 30 Oct 2026) - [CVE-2026-84912: Drupal AI module access bypass in translation](https://junglewise.ai/threats/cve-2026-84912-drupal-contrib-2026-120-this-submodule-ai-translate-enables-you) (info, published 22 Oct 2026) - [CVE-2026-84911: Drupal AI module cross-site scripting in legacy agent setup](https://junglewise.ai/threats/cve-2026-84911-drupal-contrib-2026-119-this-ai-chatbot-module-enables-you-to) (info, published 22 Oct 2026) - [CVE-2026-13235: Drupal AI missing authorization in agent tools](https://junglewise.ai/threats/cve-2026-13235-drupal-ai-missing-authorization-in-agent-tools) (info, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-13234: Drupal AI module cross-site scripting and information disclosure](https://junglewise.ai/threats/cve-2026-13234-drupal-ai-module-cross-site-scripting-and-information-disclosure) (info, CVSS 5.4, published 10 Jul 2026) - [CVE-2026-3573: DRUPAL-CONTRIB-2026-028 - The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content…](https://junglewise.ai/threats/cve-2026-3573-drupal-contrib-2026-028-the-module-and-certain-submodules-ai) (info, published 11 Mar 2026) - [CVE-2025-13981: DRUPAL-CONTRIB-2025-119 - This modules provides the ability to chat with an AI Agent using a large-language model…](https://junglewise.ai/threats/cve-2025-13981-drupal-contrib-2025-119-this-modules-provides-the-ability-to-chat) (info, published 3 Dec 2025) - [CVE-2025-31692: Drupal AI Vulnerable to OS Command Injection via Optional Automator Types](https://junglewise.ai/threats/cve-2025-31692-drupal-contrib-2025-021-the-ai-automators-module-a-submodule-of) (medium, CVSS 4, published 1 Apr 2025) - [CVE-2025-31693: Drupal AI Vulnerable to OS Command Injection](https://junglewise.ai/threats/cve-2025-31693-drupal-contrib-2025-022-the-ai-automators-module-a-submodule-of) (low, CVSS 3.1, published 1 Apr 2025) - [CVE-2025-31678: Drupal AI Missing Authorization vulnerability](https://junglewise.ai/threats/cve-2025-31678-drupal-contrib-2025-004-the-ai-logging-sub-module-enables-you-to) (low, CVSS 3.1, published 1 Apr 2025) - [CVE-2025-31677: Drupal AI Cross-Site Request Forgery (CSRF) vulnerability](https://junglewise.ai/threats/cve-2025-31677-drupal-contrib-2025-003-the-drupal-ai-module-provides-a-framework) (low, CVSS 3.1, published 1 Apr 2025) ## Most severe Packagist:Https://Packages.drupal.org/8 Drupal/Ai vulnerabilities - [CVE-2025-31692: Drupal AI Vulnerable to OS Command Injection via Optional Automator Types](https://junglewise.ai/threats/cve-2025-31692-drupal-contrib-2025-021-the-ai-automators-module-a-submodule-of) (medium, CVSS 4, published 1 Apr 2025) - [CVE-2025-31693: Drupal AI Vulnerable to OS Command Injection](https://junglewise.ai/threats/cve-2025-31693-drupal-contrib-2025-022-the-ai-automators-module-a-submodule-of) (low, CVSS 3.1, published 1 Apr 2025) - [CVE-2025-31678: Drupal AI Missing Authorization vulnerability](https://junglewise.ai/threats/cve-2025-31678-drupal-contrib-2025-004-the-ai-logging-sub-module-enables-you-to) (low, CVSS 3.1, published 1 Apr 2025) - [CVE-2025-31677: Drupal AI Cross-Site Request Forgery (CSRF) vulnerability](https://junglewise.ai/threats/cve-2025-31677-drupal-contrib-2025-003-the-drupal-ai-module-provides-a-framework) (low, CVSS 3.1, published 1 Apr 2025) - [CVE-2026-13234: Drupal AI module cross-site scripting and information disclosure](https://junglewise.ai/threats/cve-2026-13234-drupal-ai-module-cross-site-scripting-and-information-disclosure) (info, CVSS 5.4, published 10 Jul 2026) - [CVE-2026-13235: Drupal AI missing authorization in agent tools](https://junglewise.ai/threats/cve-2026-13235-drupal-ai-missing-authorization-in-agent-tools) (info, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-3573: DRUPAL-CONTRIB-2026-028 - The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content…](https://junglewise.ai/threats/cve-2026-3573-drupal-contrib-2026-028-the-module-and-certain-submodules-ai) (info, published 11 Mar 2026) - [CVE-2025-13981: DRUPAL-CONTRIB-2025-119 - This modules provides the ability to chat with an AI Agent using a large-language model…](https://junglewise.ai/threats/cve-2025-13981-drupal-contrib-2025-119-this-modules-provides-the-ability-to-chat) (info, published 3 Dec 2025) - [CVE-2026-118553: Drupal AI Automator text format access bypass](https://junglewise.ai/threats/cve-2026-118553-drupal-contrib-2026-273-the-ai-module-includes-a-submodule-ai) (info, published 30 Oct 2026) - [CVE-2026-118552: Drupal AI module cross-site scripting in HTMX attributes](https://junglewise.ai/threats/cve-2026-118552-drupal-contrib-2026-272-this-module-provides-a-framework-for) (info, published 30 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 8 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist:Https://Packages.drupal.org/8 technologies - [Packagist:Https://Packages.drupal.org/8 Drupal/Webform](https://junglewise.ai/threats/technologies/drupal-webform): 31 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Social](https://junglewise.ai/threats/technologies/drupal-social): 16 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Miniorange Saml](https://junglewise.ai/threats/technologies/drupal-miniorange-saml): 15 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Commerce](https://junglewise.ai/threats/technologies/drupal-commerce): 10 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Miniorange 2fa](https://junglewise.ai/threats/technologies/drupal-miniorange-2fa): 7 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Jsonapi](https://junglewise.ai/threats/technologies/drupal-jsonapi): 6 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Permissions By Term](https://junglewise.ai/threats/technologies/drupal-permissions-by-term): 6 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Auth Login Plus](https://junglewise.ai/threats/technologies/drupal-auth-login-plus): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Cookies](https://junglewise.ai/threats/technologies/drupal-cookies): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Facets](https://junglewise.ai/threats/technologies/drupal-facets): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Gutenberg](https://junglewise.ai/threats/technologies/drupal-gutenberg): 5 vulnerabilities - [Packagist:Https://Packages.drupal.org/8 Drupal/Tfa](https://junglewise.ai/threats/technologies/drupal-tfa): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Packagist:Https://Packages.drupal.org/8 Drupal/Ai vulnerabilities", https://junglewise.ai/threats/technologies/drupal-ai, 13 November 2026.