Skip to content

Commit 562de22

Browse files
DrupalSecurityBotgithub-actions[bot]
DrupalSecurityBot
and
github-actions[bot]
authored
feat: update advisories (#233)
🤖 beep boop - looks like there's some changes to the advisories! - https://www.drupal.org/SA-CORE-2026-003 - https://www.drupal.org/SA-CONTRIB-2026-051 - https://www.drupal.org/SA-CONTRIB-2026-052 - https://www.drupal.org/SA-CONTRIB-2026-054 - https://www.drupal.org/SA-CONTRIB-2026-055 - https://www.drupal.org/SA-CONTRIB-2026-056 - https://www.drupal.org/SA-CONTRIB-2026-057 - https://www.drupal.org/SA-CONTRIB-2026-053 - https://www.drupal.org/SA-CONTRIB-2026-058 - https://www.drupal.org/SA-CONTRIB-2026-062 - https://www.drupal.org/SA-CONTRIB-2026-060 - https://www.drupal.org/SA-CONTRIB-2026-061 - https://www.drupal.org/SA-CONTRIB-2026-063 - https://www.drupal.org/SA-CONTRIB-2026-064 - https://www.drupal.org/SA-CONTRIB-2026-059 Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 63b3da4 commit 562de22

15 files changed

Lines changed: 870 additions & 1 deletion

‎advisories/admin_feedback/DRUPAL-CONTRIB-2026-051.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-051",
4+
"modified": "2026-06-24T18:32:15.000Z",
5+
"published": "2026-06-24T18:32:15.000Z",
6+
"aliases": [
7+
"CVE-2026-13231"
8+
],
9+
"details": "This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses.\n\nThe module doesn't sufficiently sanitize several administrator-configured response messages (the \"Yes response\", \"No response\", and the custom text shown on a \"No\" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"administer admin feedback\".",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/admin_feedback"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.8.0"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.8.0"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.8.0"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-051"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Bill Seremetis (bserem)",
47+
"contact": [
48+
"https://www.drupal.org/u/bserem"
49+
]
50+
}
51+
]
52+
}

‎advisories/admin_feedback/DRUPAL-CONTRIB-2026-052.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-052",
4+
"modified": "2026-06-24T18:35:16.000Z",
5+
"published": "2026-06-24T18:35:16.000Z",
6+
"aliases": [
7+
"CVE-2026-13232"
8+
],
9+
"details": "This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote.\n\nThe module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"give feedback\". Note: \"give feedback\" is granted to anonymous and authenticated by default on install.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/admin_feedback"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "2.8.0"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<2.8.0"
30+
}
31+
}
32+
],
33+
"database_specific": {
34+
"affected_versions": "<2.8.0"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://www.drupal.org/sa-contrib-2026-052"
42+
}
43+
],
44+
"credits": [
45+
{
46+
"name": "Bill Seremetis (bserem)",
47+
"contact": [
48+
"https://www.drupal.org/u/bserem"
49+
]
50+
}
51+
]
52+
}

‎advisories/ai/DRUPAL-CONTRIB-2026-054.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-054",
4+
"modified": "2026-06-24T18:36:54.000Z",
5+
"published": "2026-06-24T18:36:54.000Z",
6+
"aliases": [
7+
"CVE-2026-13234"
8+
],
9+
"details": "The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser.\n\nUnder certain circumstances, rendering of this HTML can lead to Cross Site Scripting, or exposing secret communications in the context of the LLM request.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to inject text into prompts to create an attack.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/ai"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.2.17"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.2.17"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "1.3.0"
37+
},
38+
{
39+
"fixed": "1.3.8"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=1.3.0 <1.3.8"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "1.4.0"
51+
},
52+
{
53+
"fixed": "1.4.3"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=1.4.0 <1.4.3"
58+
}
59+
}
60+
],
61+
"database_specific": {
62+
"affected_versions": "<1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3"
63+
}
64+
}
65+
],
66+
"references": [
67+
{
68+
"type": "WEB",
69+
"url": "https://www.drupal.org/sa-contrib-2026-054"
70+
}
71+
],
72+
"credits": [
73+
{
74+
"name": "Drew Webber (mcdruid)",
75+
"contact": [
76+
"https://www.drupal.org/u/mcdruid"
77+
]
78+
}
79+
]
80+
}

‎advisories/ai/DRUPAL-CONTRIB-2026-055.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-055",
4+
"modified": "2026-06-24T18:37:45.000Z",
5+
"published": "2026-06-24T18:37:45.000Z",
6+
"aliases": [
7+
"CVE-2026-13235"
8+
],
9+
"details": "This module enables you to utilize an agent to use Drupal core actions tools with bypassed access.\n\nCertain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions.\n\nThis vulnerability is mitigated by the fact that an attacker must have access to communicate with an affected agent, the site must be configured to expose the affected tools to non-privileged users.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/ai"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.2.17"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.2.17"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "1.3.0"
37+
},
38+
{
39+
"fixed": "1.3.8"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=1.3.0 <1.3.8"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "1.4.0"
51+
},
52+
{
53+
"fixed": "1.4.3"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=1.4.0 <1.4.3"
58+
}
59+
}
60+
],
61+
"database_specific": {
62+
"affected_versions": "<1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3"
63+
}
64+
}
65+
],
66+
"references": [
67+
{
68+
"type": "WEB",
69+
"url": "https://www.drupal.org/sa-contrib-2026-055"
70+
}
71+
],
72+
"credits": [
73+
{
74+
"name": "AKHIL BABU (akhil babu)",
75+
"contact": [
76+
"https://www.drupal.org/u/akhil-babu"
77+
]
78+
},
79+
{
80+
"name": "Kuniyoshi Noguchi (kuninogu)",
81+
"contact": [
82+
"https://www.drupal.org/u/kuninogu"
83+
]
84+
}
85+
]
86+
}

‎advisories/ai_agents/DRUPAL-CONTRIB-2026-056.json‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.7.0",
3+
"id": "DRUPAL-CONTRIB-2026-056",
4+
"modified": "2026-06-24T18:38:33.000Z",
5+
"published": "2026-06-24T18:38:33.000Z",
6+
"aliases": [
7+
"CVE-2026-13236"
8+
],
9+
"details": "This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools.\n\nThe module does not sufficiently check the required permissions when a tool loads content entities.\n\nThis vulnerability is mitigated by the fact that an agent must be configured to use the affected tool, and an attacker must have access to that agent.",
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "Packagist:https://packages.drupal.org/8",
14+
"name": "drupal/ai_agents"
15+
},
16+
"severity": [],
17+
"ranges": [
18+
{
19+
"type": "ECOSYSTEM",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.1.4"
26+
}
27+
],
28+
"database_specific": {
29+
"constraint": "<1.1.4"
30+
}
31+
},
32+
{
33+
"type": "ECOSYSTEM",
34+
"events": [
35+
{
36+
"introduced": "1.2.0"
37+
},
38+
{
39+
"fixed": "1.2.5"
40+
}
41+
],
42+
"database_specific": {
43+
"constraint": ">=1.2.0 <1.2.5"
44+
}
45+
},
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "1.3.0"
51+
},
52+
{
53+
"fixed": "1.3.1"
54+
}
55+
],
56+
"database_specific": {
57+
"constraint": ">=1.3.0 <1.3.1"
58+
}
59+
}
60+
],
61+
"database_specific": {
62+
"affected_versions": "<1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1"
63+
}
64+
}
65+
],
66+
"references": [
67+
{
68+
"type": "WEB",
69+
"url": "https://www.drupal.org/sa-contrib-2026-056"
70+
}
71+
],
72+
"credits": [
73+
{
74+
"name": "Kuniyoshi Noguchi (kuninogu)",
75+
"contact": [
76+
"https://www.drupal.org/u/kuninogu"
77+
]
78+
}
79+
]
80+
}

0 commit comments

Comments
 (0)