CVE-2025-31677: Drupal AI Cross-Site Request Forgery (CSRF) Vulnerability
Summary
CVE-2025-31677: Drupal AI Cross-Site Request Forgery (CSRF) vulnerability. Affects drupal/ai versions >= 1.0.0, < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal AI is a module designed to integrate artificial intelligence functionalities into Drupal-based websites. It enhances user experience by providing intelligent features such as content recommendations and automated responses. However, the module has been found to be vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can compromise the integrity of user actions within the application.
Vulnerability Detail
The Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI allows an attacker to perform unauthorized actions on behalf of a user without their consent. This vulnerability arises from insufficient verification of requests, enabling malicious actors to exploit the trust a user has in the application. If exploited, this could lead to unauthorized data manipulation or actions that could compromise user accounts and sensitive information.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
composer require drupal/ai:1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to limit user permissions and ensure that sensitive actions require additional verification, such as re-authentication or confirmation prompts.
Conclusion
The CSRF vulnerability in Drupal AI poses a significant risk to user security and data integrity. It is crucial to update to the patched version 1.0.2 to mitigate this risk. For those unable to update immediately, implementing workarounds can help reduce exposure until a proper fix is applied.
See every vulnerability recorded for drupal/ai →
FAQ
CSRF is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized actions being taken on behalf of users, potentially compromising sensitive data and user accounts.
Yes, you can limit user permissions and require additional verification for sensitive actions as a temporary workaround.
If immediate updates are not possible, implement the suggested workarounds and monitor your application closely for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/ai.
