Drupal AI CVE-2026-84911

Exploitation requires an attacker to already possess a privileged Drupal account (PR:H per the vendor CVSS vector) capable of storing input that the AI (Artificial Intelligence) contrib module later renders, and it additionally requires a victim user to view the page containing the stored payload (UI:R). The affected deployments are Drupal sites running the AI module at versions 0.0.0-1.3.13 or 1.4.0-1.4.8. The precise input field and trigger mechanism are not described in the available sources. Limiting factors that reduce real-world risk: the need for a pre-existing high-privilege account, mandatory victim interaction, high attack complexity (AC:H) as scored by the vendor, and applicability only to the unpatched version ranges - updating to the fixed releases per the Drupal advisory is the remediation the vendor provides.

This is a low-severity stored XSS (NVD CVSS 3.1 base 3.1) with a weak exploitation profile across every available signal. The supplied vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N combines high attack complexity, high privileges required, and mandatory user interaction, all of which sharply constrain exploitability; impact is limited (C:L/I:L, no availability effect, no scope change). No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit was supplied - only a Drupal security advisory and the NVD detail page. The vuln.today decision label is 'monitor,' consistent with the low CVSS and absence of exploitation evidence. There is no conflict between the signals: all of them point to a low, non-urgent issue rather than a high-CVSS-but-overrated one. The one metric worth scrutiny is scope - stored XSS commonly executes in another user's browser context, which many assessors score as S:C; NVD recorded S:U, so verify scope with the vendor if precise scoring matters. Overall this is a patch-in-normal-maintenance item, not a priority response.

A user who already holds a privileged Drupal account on a site running the AI module stores a malicious script through an input field that the module later renders without proper neutralization. When another authenticated user (such as an administrator) subsequently views the page containing that stored payload, the script executes in their browser session. No public exploit code was supplied, and the exact field and trigger are not described in the available sources.