Project: 
AI CKEditor
Project machine name: 
ai_ckeditor
Date: 
2026-September-23
Security risk: 
Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: 
Code execution via Twig templates
Affected versions: 
<1.4.3
CVE IDs: 
CVE-2026-96392
Description: 

This module enables you to use AI to fill in or replace text in CKEditor.

The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: