GHSA-pwjq-fx3v-8f9r

Drupal AI Vulnerable to OS Command Injection via Optional Automator Types

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-31692

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	drupal/ai	< 1.0.5	1.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection. This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-31692 advisory
https://git.drupalcode.org/project/ai package
https://www.drupal.org/sa-contrib-2025-021 web