Project: 
AI (Artificial Intelligence)
Project machine name: 
ai
Date: 
2026-October-28
Security risk: 
Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: 
Information disclosure
Affected versions: 
<1.4.11 || >=1.5.0 <1.5.2
CVE IDs: 
CVE-2026-118548
Description: 

This module enables you to use AI on the website. It also enables you to interact with AI providers.

The module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites.

This vulnerability is mitigated by the fact that an attacker must use untrusted sources when interacting with the AI module in a way that produces rendered HTML.

Solution: 

Install the latest version:

  • If you use version 1.5.x, upgrade to AI 1.5.2
  • If you use version 1.4.x, upgrade to AI 1.4.11
  • If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.
Reported By: 
Fixed By: 
Coordinated By: