nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-13981 CVE-2025-13981
MEDIUM
AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119
Record summary
CVE-2025-13981 has a selected CVSS score of 4.4 (medium).
Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 29, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
AI (Artificial Intelligence)Browse Drupal / AI (Artificial Intelligence)Default status: unaffected | CVE List | 0.0.0 to < 1.0.7 | affected |
| 1.1.0 to < 1.1.7 | affected | ||
| 1.2.0 to < 1.2.4 | affected |
References
2drupal.org
https://www.drupal.org/sa-contrib-2025-119