CVE-2026-84911: Drupal AI Chatbot Module XSS Vulnerability
Summary
CVE-2026-84911: This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. Affects drupal/ai across 2 version ranges.
< 1.3.13
>= 1.4.0, < 1.4.8
Fixed in 1.3.13 or 1.4.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AI Chatbot module for Drupal allows users to integrate chatbot functionalities into their websites, utilizing various AI assistants to enhance user interaction. This module is designed to improve user engagement and provide automated support. However, it has been found to have a vulnerability that can lead to cross-site scripting (XSS) attacks under specific configurations.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of user inputs when using structured results with legacy agent setups. An attacker can exploit this flaw by injecting malicious scripts through editorial content, potentially compromising the integrity of the website. The risk is heightened when the site is configured with AI 1.0.x and AI Agents 1.0.x versions, particularly with uncommon configurations. If exploited, this could lead to unauthorized actions being performed on behalf of users or the exposure of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.131.3.13 -
>= 1.4.0, < 1.4.81.4.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using legacy agent setups and ensure that your site is configured with the latest versions of the AI module. Regularly review and sanitize any editorial content that may be used to invoke prompts.
Conclusion
The CVE-2026-84911 vulnerability in the Drupal AI Chatbot module poses a significant risk due to its potential for cross-site scripting attacks. It is crucial for users to update their modules to the latest patched versions and to implement best practices in content sanitization to mitigate risks.
See every vulnerability recorded for drupal/ai →
FAQ
CVE-2026-84911 is a vulnerability in the Drupal AI Chatbot module that allows for cross-site scripting (XSS) attacks due to insufficient input sanitization.
Websites using the AI Chatbot module with versions prior to 1.3.13 or between 1.4.0 and 1.4.8 are affected, especially if configured with legacy agent setups.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, avoid using legacy agent setups and sanitize any editorial content that could be exploited.
More information can be found in the advisory published by the Drupal Security Team and on vulnerability databases like CVE.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/ai.
