[IT-SecNots] [Security-news] DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-112

Project: DXPR Builder: The AI Visual  Page Builder for Drupal [1]
Date: 2026-August-26
Security risk: *Moderately critical* 14 ∕ 25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Information Disclosure

Affected versions: <2.8.1
CVE IDs: CVE-2026-81162
Description: 
The DXPR Builder [3] module provides a visual / AI page builder for Drupal.
The module uses a JSON Web Token for licensing, user license management, AI
services, and subscription metadata.

The 2.x version of the module does not sufficiently restrict access to API
credentials in JavaScript settings. When AI agent features are enabled, the
token is exposed to all page visitors (including anonymous users) via
drupalSettings.

This vulnerability is mitigated by the fact that a site must have DXPR
Builder AI features enabled and configured with an API token.

Solution: 
Install the latest version:

 * If you use the 2.x branch of the DXPR Builder module, upgrade to DXPR
   Builder 2.8.1 or later [4].
 * The 3.x branch is not affected as it proxies AI requests through the
   contributed AI [5] module.

Reported By: 
 * jurriaanroelofs [6]

Fixed By: 
 * jurriaanroelofs [7]

Coordinated By: 
 * Greg Knaddison (greggles) [8] of the Drupal Security Team
 * Juraj Nemec (poker10) [9] of the Drupal Security Team
 * Jess  (xjm) [10] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [11]

[1] https://www.drupal.org/project/dxpr_builder
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/dxpr_builder
[4] https://www.drupal.org/project/dxpr_builder/releases/2.8.1
[5] https://www.drupal.org/project/ai
[6] https://www.drupal.org/u/jurriaanroelofs
[7] https://www.drupal.org/u/jurriaanroelofs
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10
[10] https://www.drupal.org/u/xjm
[11]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3617625

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at