This vulnerability is classified under CWE-79, indicating improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). The affected product is Drupal AI (Artificial Intelligence), with multiple affected versions identified. The vulnerability allows attackers to inject malicious scripts into web pages generated by the affected versions, potentially leading to client-side code execution. There is no information on available patches or official remediation from the vendor at this time. The vulnerability is published and reserved under CVE-2026-13234 but lacks a CVSS score and known exploits in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, no known exploits are reported in the wild, and the exact impact depends on the context in which the vulnerable component is used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding as temporary mitigations to reduce the risk of XSS. Monitor official Drupal channels for updates regarding patches or official fixes.