What happened
The Drupal AI (Artificial Intelligence) contrib module shipped a cluster of issues fixed across SA-contrib-2026-266 through -273: multiple XSS (CVE-2026-118545/118546/118549/118552/118553), incorrect authorization/resource injection (CVE-2026-118548), and browser-cache/insecure-storage issues (CVE-2026-118550/118551).
Why it matters
Drupal AI exposes AI chat/generation to site users. A combination of stored XSS and incorrect authorization in the module allows an attacker to run script in other users' sessions and over-reach content that should be gated, affecting the AI-generated content and any connected accounts.
Attack vector
Multiple weaknesses across the module's AI interaction surfaces: reflected and stored cross-site scripting, incorrect authorization allowing forceful browsing (resource injection), browser-cache storage of sensitive data and insecure storage of sensitive information in the AI module.
Affected systems
Drupal AI (Artificial Intelligence) contributions from 0.0.0 to 1.4.11, and 1.5.0 to 1.5.2 (fixed in the corresponding SA-contrib releases).
Mitigation
Update the Drupal AI contrib module to the patched releases referenced in SA-contrib-2026-266 through SA-contrib-2026-273; restrict who can access AI-generated content and clear cached AI data.