Security advisories

This module enables you to share and reuse content across websites.

The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password.

This vulnerability is mitigated by the fact that an attacker must have access to a database dump or database read access to the user data table. This vulnerability is not exploitable without prior database access.

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting.

The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field configured as "Private" on one of these entities can be viewed. Where the entity is editable, the entity can also be edited by anyone who can view it, including anonymous users.

The module enables authentication via the OpenID Connect (oAuth2) protocol.

When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user.

This vulnerability is mitigated by the fact that the site must be configured to use a provider that doesn't verify the email address of the user.

This module enables users to create and save signatures as SVG images.

The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a cross-site scripting (XSS) vulnerability.

This module provides a bulk form for assigning or removing roles on multiple user accounts at once.

The bulk update form does not prevent access to users who do not have permission to assign roles.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users".

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page.

The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user with the "Use Fasttoggle" permission visits a page controlled by an attacker while logged in. This allows the attacker to change the publication status of arbitrary content on behalf of that user.

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved.

The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing.

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons.

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites.

A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution.

This vulnerability is mitigated by the fact that an attacker must have a role with the "import single content" permission.

The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields.

The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to.

This module provides a framework for integrating AI providers and features into Drupal.

Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription.

This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing.

The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS).

This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot.

Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have access to administer blocks.

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.

Under certain rare circumstances, the module may expose a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have administrator permissions to configure payment gateways and use the Stripe Connect in conjunction with the compromise of an external service.

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.

When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow a an attacker to trick an administrator to click a link that bypasses Stripe payment for an order, meaning that the order would be marked as paid without any actual payment.

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment.

The module doesn't sufficiently protect shipment references and shipment entity fields, leading to an access bypass that can result in inappropriately modified shipment states or deleted shipments.

This vulnerability is mitigated by the fact that an attacker must have a cart with API-based access to manipulate its shipments.

This module enables you to sell goods and services to customers through a shopping cart and checkout form.

The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can make repeated requests that eventually determine certain field values on an unpublished product variation, or a variation of an unpublished product.

This vulnerability is mitigated by the fact that the core JSON:API module must be enabled.

This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can also create multiple online stores that are managed by different users.

The module doesn't check access properly when a store is saved. A user who can either create stores or edit their own store is able to mark their store as the site's default store. This causes their store to get some orders they normally shouldn't.

This module enables you to sell goods and services to customers through a shopping cart and checkout form.

When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission.

This vulnerability is mitigated by only affecting sites with published products and unpublished product variations.

This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds.

When the input of the node creation form is processed, it makes use of PHP's unserialize function. This introduces a PHP object injection vulnerability.

This vulnerability is mitigated by the fact that the RSS Page submodule must be enabled and an attacker must have a role with the permission "RSS Feed: Create new content".

The AI File to Text module extracts text from uploaded documents, including
Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool.

The module does not sufficiently check whether the current user is permitted
to view a file before extracting its contents. This allows the contents of files the user could not otherwise download, including files held in the private file system,
to be disclosed.

This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to them.

The module doesn't sufficiently enforce these restrictions when a user logs in by a method other than the standard login form.

This vulnerability is mitigated by the fact that an attacker must have a valid user account on the site, and the "Enable restriction" setting must be enabled on the Domain settings page. Users with the "Login to any domain" permission are not affected by the restriction.

This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them.

The module serves WebP image derivative responses with the HTTP header Cache-Control: public for all file schemes other than the private file system, including the temporary file system and access-controlled custom schemes. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN.

This module allows for direct viewing of a file with the URL alias.

In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.

This vulnerability is mitigated by the following: