[IT-SecNots] [Security-news] AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-076

Project: AI SEO/GEO Analyzer [1]
Date: 2026-July-08
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross-site Scripting

Affected versions: <1.1.3
CVE IDs: CVE-2026-15085
Description: 
The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending
content of an entity (including its comments) to an LLM, then converts the
model's Markdown response to HTML and stores it for display to privileged
users.

The generated HTML was rendered without passing through Drupal's filtering
pipeline, so it relied on the LLM output being safe. Under certain
circumstances a crafted prompt injection — planted in content that is
included in the analysis — can cause the LLM to emit markup that results in
stored Cross-site Scripting when the report is later viewed.

This vulnerability is mitigated by the fact that an attacker must be able to
inject text into the content that is sent to the LLM, and that prompt
injection is non-deterministic and not guaranteed to succeed on a given
attempt.

Solution: 
Install the latest version:

 * If you use the AI SEO/GEO Analyzer module 1.1.x, upgrade to ai_seo 1.1.3
   [3]

Reported By: 
 * Drew Webber (mcdruid) [4] of the Drupal Security Team

Fixed By: 
 * Juhani Väätäjä (j-vee) [5]

Coordinated By: 
 * Greg Knaddison (greggles) [6] of the Drupal Security Team
 * Drew Webber (mcdruid) [7] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185231-ai_seo-security/-/work_items/1
[8]
------------------------------------------------------------------------------
Contribution record [9]

[1] https://www.drupal.org/project/ai_seo
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ai_seo/releases/1.1.3
[4] https://www.drupal.org/u/mcdruid
[5] https://www.drupal.org/u/j-vee
[6] https://www.drupal.org/u/greggles
[7] https://www.drupal.org/u/mcdruid
[8] https://git.drupalcode.org/security/185231-ai_seo-security/-/work_items/1
[9]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3609093

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at