DRUPAL-CONTRIB-2025-004

The advisory, in context

The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes.

The module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged.

This vulnerability is mitigated by the fact that it only affects sites using the AI Logging sub-module with 'Log requests' enabled in the AI Logging configuration page.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

drupal/ai Packagist:https://packages.drupal.org/8

Ecosystem versions

Earlier releases before 1.0.3

Fixed in 1.0.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.3"
        }
      ],
      "type": "ECOSYSTEM",
      "database_specific": {
        "constraint": "<1.0.3"
      }
    }
  ],
  "versions": []
}

drupal/ai Packagist