CVE-2025-31692: Drupal AI OS Command Injection Vulnerability
Summary
CVE-2025-31692: Drupal AI Vulnerable to OS Command Injection via Optional Automator Types. Affects drupal/ai versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal AI is a package within the Drupal ecosystem that leverages artificial intelligence to enhance user experiences and automate various tasks. It is designed to integrate AI functionalities seamlessly into Drupal applications, providing developers with tools to create intelligent features. However, a vulnerability has been identified that allows for OS command injection, posing a significant security risk to applications utilizing this package.
Vulnerability Detail
The vulnerability arises from improper neutralization of special elements used in an OS command, which can lead to OS Command Injection. This flaw allows an attacker to execute arbitrary commands on the server where the Drupal AI package is installed. The issue affects versions from 0.0.0 up to, but not including, 1.0.5. If exploited, this vulnerability could allow unauthorized access to sensitive system resources, potentially leading to data breaches or system compromise.
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
composer require drupal/ai:1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate updating is not feasible, consider disabling the features of the Drupal AI package that utilize the vulnerable automator types until the package can be updated. This can help reduce the risk of exploitation.
Conclusion
The OS Command Injection vulnerability in Drupal AI (CVE-2025-31692) poses a significant risk to applications using this package. It is crucial to update to version 1.0.5 or later to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing monitoring and assessment of their applications' security.
See every vulnerability recorded for drupal/ai →
FAQ
OS Command Injection is a type of security vulnerability that allows an attacker to execute arbitrary commands on the host operating system via a vulnerable application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your composer.lock file, Vulert can identify if your application is affected by this vulnerability.
Exploitation of this vulnerability could lead to unauthorized access to the server, data breaches, and potentially full system compromise.
Yes, temporarily disabling the features that utilize the vulnerable automator types can help mitigate the risk until an update can be applied.
More information can be found in the official advisory on GitHub or by visiting Vulert for real-time monitoring of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/ai.
