Security advisories

This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.

The module does not sufficiently check the required permissions when a tool loads content entities.

This vulnerability is mitigated by the fact that an agent must be configured to use the affected tool, and an attacker must have access to that agent.

The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser.

Under certain circumstances, rendering of this HTML can lead to Cross Site Scripting, or exposing secret communications in the context of the LLM request.

This vulnerability is mitigated by the fact that an attacker must be able to inject text into prompts to create an attack.

This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote.

The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "give feedback". Note: "give feedback" is granted to anonymous and authenticated by default on install.

The JSON:API and REST modules allow you to upload image files to image fields.

The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.

Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.