Most recent entries from all

DRUPAL-CONTRIB-2026-134

Affected: Packagist:https://packages.drupal.org/8: drupal/ai_provider_amazeeio

**Update 2026-09-11:** Increased risk score to reflect publicly documented methods for developing exploits.

This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search.

The module doesn't sufficiently sanitize filter values before using them to build SQL queries in its Postgres/pgvector backend, allowing SQL injection.

This vulnerability is mitigated by the fact that a site must be using the module's Postgres/pgvector vector database backend for a Search API AI Search index, and must expose one of that index's non-string fields as a filter (for example, through a View) that is reachable by the attacker.

fkie_cve-2026-87936

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

GHSA-28qc-3cgq-p54x

WID-SEC-W-2026-3284 — Drupal Erweiterungen: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Datenbankinhalte zu manipulieren oder auszulesen, Zugriffsbeschränkungen und Authentifizierungsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, Cross Site Scripting Angriffe auszuführen, Benutzer auf manipulierte Webseiten umzuleiten, SAML-Authentifizierungen zu beeinflussen oder wiederzuverwenden, interne Ressourcen über SSRF anzusprechen sowie unberechtigt Dateien auf den Server hochzuladen.