Project: 
AI (Artificial Intelligence)
Project machine name: 
ai
Date: 
2026-October-28
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-site scripting
Affected versions: 
<1.4.11 || >=1.5.0 <1.5.2
CVE IDs: 
CVE-2026-118546
Description: 

This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot.

Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have access to administer blocks.

Solution: 

Install the latest version:

  • If you use version 1.5.x, upgrade to AI 1.5.2.
  • If you use version 1.4.x, upgrade to AI 1.4.11.
  • If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.
Reported By: 
Fixed By: 
Coordinated By: