[IT-SecNots] [Security-news] AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-187

Project: AI CKEditor [1]
Project machine name: ai_ckeditor
Date: 2026-September-23
Security risk: *Moderately critical* 10 ∕ 25
AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Code execution via Twig templates

Affected versions: <1.4.3
CVE IDs: CVE-2026-96392
Description: 
This module enables you to use AI to fill in or replace text in CKEditor.

The module doesn't sufficiently mitigate Twig template injections in certain
AI CKEditor rules, making it possible to use Twig functions to extract
certain confidential system data.

Solution: 
Install the latest version:

 * If you use the AI CKEditor module, upgrade to AI CKEditor 1.4.3 [3].

Reported By: 
 * Stef Rouschop (stefro) [4]

Fixed By: 
 * Artem Dmitriiev (a.dmitriiev) [5]
 * Marcus Johansson (marcus_johansson) [6]
 * Stef Rouschop (stefro) [7]

Coordinated By: 
 * Bram Driesen (bramdriesen) [8] of the Drupal Security Team
 * Greg Knaddison (greggles) [9] of the Drupal Security Team
 * Dave Long (longwave) [10] of the Drupal Security Team
 * Juraj Nemec (poker10) [11] of the Drupal Security Team
 * Jess  (xjm) [12] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [13]

[1] https://www.drupal.org/project/ai_ckeditor
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ai_ckeditor/releases/1.4.3
[4] https://www.drupal.org/u/stefro
[5] https://www.drupal.org/u/admitriiev
[6] https://www.drupal.org/u/marcus_johansson
[7] https://www.drupal.org/u/stefro
[8] https://www.drupal.org/u/bramdriesen
[9] https://www.drupal.org/u/greggles
[10] https://www.drupal.org/u/longwave
[11] https://www.drupal.org/u/poker10
[12] https://www.drupal.org/u/xjm
[13]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3624915

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at