Drupal AI Module Advisories: Eight Fixes on October 28, One Critical, and What to Update

The Drupal AI module received eight security advisories on October 28, 2026, and one of them is rated Critical. The fixes ship in AI 1.5.2 and 1.4.11. Sites still on the 1.3.x branch have no patch, because that branch is no longer supported.

This post is a follow-up to our September look at the Drupal AI Security Initiative and the advisory count. That post covered why more Drupal bugs are being found. This one covers what the eight fixes in the Drupal AI module do, which version to install, and the lesson that applies to any CMS: text a model writes is untrusted input once it is shown as HTML or Markdown.

The short version: update the Drupal AI module to 1.5.2 or 1.4.11 this week. If you are on 1.3.x, move to one of those. If you use the old AI Search submodule, also plan a move to the standalone AI Search module. Five of the eight advisories are cross-site scripting (XSS), the bug that lets someone run their own script in another user’s browser.

The eight Drupal AI module advisories at a glance

Drupal published 39 contributed project advisories on October 28, according to its contrib advisories list. Eight of them, SA-CONTRIB-2026-266 through 273, are for the AI (Artificial Intelligence) module. Drupal rates risk on a 25-point scale, and its risk level definitions put Critical at 15 to 19.

Every one has the same fix: AI 1.5.2 or 1.4.11. The AI project page shows both releases dated October 28 and reports 27,603 sites using the module.

The Critical one: Markdown links in SA-CONTRIB-2026-269

The SA-CONTRIB-2026-269 advisory explains that the Drupal AI module has a service "that helps any consumer of the module to stop cross site scripting elements from appearing." The flaw is in that safety service. The advisory says the module "does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS)."

The risk score is 15 out of 25. The vector shows why it ranks highest. No authentication is needed. Default configurations are affected. Drupal marks the exploit as theoretical, which its definitions describe as no public exploit code or documentation.

Why Markdown links? Many AI features return answers in Markdown, which the site turns into HTML for display. A Markdown link can point to more than a web page. If a link is not checked, it can carry script that runs when a visitor clicks. The advisory does not name the exact link pattern.

The other XSS fixes in the Drupal AI module

Four more advisories are XSS. Each needs some level of access, which is why they score lower.

• SA-CONTRIB-2026-266 says the module does not restrict HTML rendering well enough. The attacker needs access to a text format that can render HTML.
• SA-CONTRIB-2026-272 says the module "doesn’t sufficiently sanitize certain HTMX attributes." HTMX is a library that lets HTML attributes trigger page requests. It was reported by a member of the Drupal Security Team.
• SA-CONTRIB-2026-267 covers the AI Chatbot submodule. Under some setups it does not filter user input before showing it. The attacker must be able to administer blocks.
• SA-CONTRIB-2026-273 covers AI Automators, which fill in fields using AI. It did not check whether a user may use a given text format. Drupal says only uncommon setups are exposed.

Text formats are one of Drupal’s main XSS defenses. They decide which HTML tags each role can save. The AI Automators bug let content skip that check. Review who holds the "Full HTML" format and block admin rights on your sites.

Data exposure: links, audio and search results

The other three advisories are about data reaching the wrong person.

The SA-CONTRIB-2026-268 advisory says the module "does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites." It adds that an attacker "must use untrusted sources when interacting with the AI module in a way that produces rendered HTML." In plain terms: if a model reads untrusted content, such as a web page or an uploaded file, that content can steer it into writing a link that sends data elsewhere. Our post on prompt injection through pasted text covers how untrusted content steers a model.

SA-CONTRIB-2026-270 covers the AI Search submodule. According to the advisory, Search API result caching could show titles and other fields of unpublished or restricted content to users without access. It applies only when a Search API view uses time-based or tag-based caching. The submodule is now deprecated. The standalone AI Search module had the same bug, and the advisory lists fixes in 1.3.0-alpha6 and 2.0.0-alpha3.

SA-CONTRIB-2026-271 is the lowest risk. The advisory says audio for every speech-to-text request was written to the same file in the temp folder and never deleted. Someone with read access to that folder, such as another account on shared hosting, could get another user’s audio. The fix keeps audio in memory. Drupal suggests deleting any leftover speech_to_text.mp3 file.

Which Drupal AI module version to install

The project page lists three branches. The 1.5.x branch is current. The 1.4.x branch is "Supported until 1.6.0 is out." The 1.3.x branch is marked "Unsupported, do not use anymore."

• On 1.5.x: install 1.5.2.
• On 1.4.x: install 1.4.11, then plan a move to 1.5.x before 1.6.0 ships.
• On 1.3.x: move to 1.5.2 or 1.4.11. There is no 1.3.x fix.
• Using AI Search: update the AI module, and move to the standalone AI Search module, which the advisory calls the drop-in replacement.

Both new releases require Drupal 10.5 or later, or Drupal 11.2 or later. Sites on older core minors need a core update first. With Composer, update the drupal/ai package and run database updates.

Drupal’s core release schedule puts Drupal 12 in the week of December 7, the same week Drupal 10 ends.

The cross-platform lesson: AI output is untrusted input

Five of these eight bugs share one pattern. Text that came from a model, a user or a document reached the browser without enough checks. That is not unique to Drupal. Any WordPress plugin, chatbot widget or custom app that shows AI answers as HTML or Markdown faces it.

The OWASP Top 10 for LLM Applications lists this as LLM05:2025, Improper Output Handling. One of its examples: "JavaScript or Markdown is generated by the LLM and returned to a user." The browser then runs it, "resulting in XSS." OWASP’s first fix is to "Treat the model as any other user, adopting a zero-trust approach." It also says to "Encode model output back to users to mitigate undesired code execution by JavaScript or Markdown," and recommends a strict Content Security Policy.

For your sites, that means three checks:

1. Filter AI output like comments. Run it through the same sanitizer and text format you use for anonymous input. Do not give it Full HTML.
2. Check every link scheme. Allow https and your own paths. Block javascript: and data: links, and be wary of image links to outside hosts.
3. Set a Content Security Policy. It limits what injected script can do if a filter misses.

Our October 21 contrib advisories post shows how we sort a long list by risk, and this batch follows the same order.

What to do this week

The same October 28 batch held the exploited Commerce Core flaw. If you run Drupal Commerce, our post on the Drupal Commerce vulnerability comes first. Then:

1. Update the Drupal AI module to 1.5.2 or 1.4.11 on every site that has it.
2. Retire 1.3.x wherever you find it.
3. Move off the AI Search submodule to the standalone module.
4. Delete leftover audio files named speech_to_text.mp3 from temp folders.
5. Review text format and block admin permissions for roles that use AI features.
6. Audit custom code that renders model output, using the three checks above.

Frequently Asked Questions