The DXPR Builder module provides a visual / AI page builder for Drupal.
Impact
The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.
Source excerpt · OSVThis vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.8.1Ecosystem versions | 2.8.1 |
Version evidence: OSV · DRUPAL-CONTRIB-2026-112
View original version evidence (0 explicit versions)
Original source description
The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.
The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via drupalSettings.
This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.