EUVD-2026-107814
GHSA-xxh3-46q2-4vrc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Drupal user
-
ExploitSubmit crafted template syntax via AI CKEditor
-
ExecutionTrigger template evaluation on render
-
ImpactAchieve limited code injection
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Template injection prevention
|
| Exploitation Conditions | Requires an authenticated Drupal account with permission to use the AI CKEditor module's features (CVSS PR:L), plus user interaction (UI:R) for the crafted template input to be processed/rendered. The specific product feature, CKEditor configuration, or rendering path that evaluates the unneutralized template syntax is not detailed in the available sources, so the exact trigger is not described in the available sources. Limiting factors that reduce real-world risk: valid authentication is needed, exploitation is not fully automatic (interaction required), scope is unchanged, and only sites running AI CKEditor below 1.4.3 are affected. Updating to 1.4.3 is the vendor-provided fix. |
| Impact | This is a low-priority issue despite being a code-injection/template-injection class flaw (CWE-1336). The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) scores it only 3.5, and the vuln.today decision label is 'monitor' - the weakest urgency tier - both of which align. Key limiting signals: exploitation requires an already-authenticated user (PR:L) plus user interaction (UI:R), the scope is unchanged (S:U), and impact is capped at low confidentiality with NO integrity or availability impact (I:N/A:N). That impact profile is notably conservative for a vulnerability titled 'Code Injection' via a template engine, which as a class (SSTI) often enables arbitrary code execution and full compromise; this tension between the flaw class and the vendor-assigned low impact should be verified against the Drupal advisory before deprioritizing entirely. There is no EPSS score, no CISA KEV listing, and no public exploit reference in the provided data, so exploitation is neither probable nor observed. Overall this is a genuine but low-severity, authenticated, interaction-dependent issue - not an emergency. |
| Exploit ScenarioDerived | An authenticated Drupal user who has permission to use the AI CKEditor module submits content containing crafted special characters that the template engine fails to neutralize. When that content is subsequently processed/rendered (the required user interaction), the injected template expression is evaluated, yielding limited code injection against the site. No public exploit code was identified in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Template injection (CWE-1336) in the Drupal AI CKEditor module affects versions 0.0.0 through 1.4.3, allowing an authenticated Drupal user who can use the module's features to inject unneutralized template syntax that is later evaluated by a template engine, producing limited code injection. Successful exploitation requires the victim to interact with crafted content (CVSS PR:L/UI:R), and impact is confined to low confidentiality and integrity effects within the unchanged component scope. No public exploit code or active exploitation has been reported, and availability of an updated release (1.4.3) keeps priority at monitor level.
RemediationAI
Upgrade the AI CKEditor Drupal module to 1.4.3 or later, which the vendor provides as the fix (per the Drupal advisory https://www.drupal.org/sa-contrib-2026-187); sites that cannot update immediately should consider disabling the module until the update can be applied, accepting the loss of its CKEditor/AI editing features. Because exploitation requires an authenticated account with permission to use the module's features plus a user-interaction step, restricting those permissions to trusted roles and limiting who can author content processed by the module reduces exposure while the update is scheduled. No public exploit code or active exploitation is known, consistent with the monitor-level priority assigned to this issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-1336, Improper Neutralization of Special Elements Used in a Template Engine, meaning user-supplied content reaches a template engine without the special syntax being escaped or stripped, so template directives can be interpreted rather than treated as literal text. The affected component is the Drupal contributed module AI CKEditor, tracked by CPE cpe:2.3:a:drupal:ai_ckeditor and covering releases from 0.0.0 up to and including 1.4.3. The sources identify the module and the injection class but do not specify which CKEditor-integrated feature, configuration or rendering/evaluation path processes the template syntax, so the precise trigger is not described in the available sources. The assessed vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) indicates the attack surface is network-reachable, requires a valid authenticated account with permission to use the module's features, and depends on a user-interaction step before the crafted template input is processed.
Know when Ai Ckeditor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Network-reachable but needs an authenticated low-privileged account (PR:L) and interaction to render injected template input (UI:R); code injection plausibly affects confidentiality and integrity at low level, no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB