Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows… (CVE-2026-84911)

CVE-2026-84911 describes a stored cross-site scripting vulnerability in Drupal AI versions 0.0.0 through 1.3.13 and 1.4.0 through 1.4.8. The flaw arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of users viewing the affected pages. Exploitation requires high privileges and user interaction, and the vulnerability impacts confidentiality and integrity with no availability impact. No known exploits are reported in the wild, and no patch or remediation information is provided in the source data.

Successful exploitation could allow an attacker with high privileges to inject and execute malicious scripts in the context of other users, potentially leading to limited confidentiality and integrity breaches. The vulnerability does not affect system availability. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Given the requirement for high privileges and user interaction, limiting administrative access and user privileges may reduce risk until a fix is available.