DRUPAL-CONTRIB-2026-187unknown
DRUPAL-CONTRIB-2026-187
The advisory, in context
This module enables you to use AI to fill in or replace text in CKEditor.
The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/ai_ckeditor Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.4.3
Fixed in 1.4.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.4.3"
}
}
],
"versions": []
}