Ai Ckeditor
Monthly
Template injection (CWE-1336) in the Drupal AI CKEditor module affects versions 0.0.0 through 1.4.3, allowing an authenticated Drupal user who can use the module's features to inject unneutralized template syntax that is later evaluated by a template engine, producing limited code injection. Successful exploitation requires the victim to interact with crafted content (CVSS PR:L/UI:R), and impact is confined to low confidentiality and integrity effects within the unchanged component scope. No public exploit code or active exploitation has been reported, and availability of an updated release (1.4.3) keeps priority at monitor level.
Template injection (CWE-1336) in the Drupal AI CKEditor module affects versions 0.0.0 through 1.4.3, allowing an authenticated Drupal user who can use the module's features to inject unneutralized template syntax that is later evaluated by a template engine, producing limited code injection. Successful exploitation requires the victim to interact with crafted content (CVSS PR:L/UI:R), and impact is confined to low confidentiality and integrity effects within the unchanged component scope. No public exploit code or active exploitation has been reported, and availability of an updated release (1.4.3) keeps priority at monitor level.