Vulnerability-Lookup

CVE-2026-15085 (GCVE-0-2026-15085)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-10 21:46

Title

AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-076

Impacted products

1 product

Vendor	Product	Version
Drupal	AI SEO/GEO Analyzer	Affected: 0.0.0 , < 1.1.3 (semver)

Date Public

2026-07-08 17:18

Credits

Drew Webber (mcdruid) Juhani VÃ¤Ã¤tÃ¤jÃ¤ (j-vee) Greg Knaddison (greggles) Drew Webber (mcdruid)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/ai_seo",
          "product": "AI SEO/GEO Analyzer",
          "repo": "https://git.drupalcode.org/project/ai_seo",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.1.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Juhani V\u00c3\u00a4\u00c3\u00a4t\u00c3\u00a4j\u00c3\u00a4 (j-vee)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        }
      ],
      "datePublic": "2026-07-08T17:18:39.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:35.632Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-076"
        }
      ],
      "title": "AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15085",
    "datePublished": "2026-07-10T21:46:35.632Z",
    "dateReserved": "2026-07-08T15:44:59.219Z",
    "dateUpdated": "2026-07-10T21:46:35.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-15085",
      "date": "2026-07-11",
      "epss": "0.00254",
      "percentile": "0.16686"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-15085\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2026-07-10T22:16:41.230\",\"lastModified\":\"2026-07-10T22:16:41.230\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Input During Web Page Generation (\\\"Cross-site Scripting\\\") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.\"}],\"affected\":[{\"source\":\"mlhess@drupal.org\",\"affectedData\":[{\"vendor\":\"Drupal\",\"product\":\"AI SEO/GEO Analyzer\",\"collectionURL\":\"https://www.drupal.org/project/ai_seo\",\"repo\":\"https://git.drupalcode.org/project/ai_seo\",\"versions\":[{\"version\":\"0.0.0\",\"lessThan\":\"1.1.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"weaknesses\":[{\"source\":\"mlhess@drupal.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://www.drupal.org/sa-contrib-2026-076\",\"source\":\"mlhess@drupal.org\"}]}}"
  }
}

drupal-contrib-2026-076

Vulnerability from drupal

Published

2026-07-08 17:18

Modified

2026-07-08 17:18

Summary

Details

The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users.

The generated HTML was rendered without passing through Drupal's filtering pipeline, so it relied on the LLM output being safe. Under certain circumstances a crafted prompt injection — planted in content that is included in the analysis — can cause the LLM to emit markup that results in stored Cross-site Scripting when the report is later viewed.

This vulnerability is mitigated by the fact that an attacker must be able to inject text into the content that is sent to the LLM, and that prompt injection is non-deterministic and not guaranteed to succeed on a given attempt.

Credits

Drew Webber (mcdruid) www.drupal.org/u/mcdruid

References

URL

Type

https://www.drupal.org/sa-contrib-2026-076

WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.1.3"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/ai_seo"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.1.3"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-15085"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/mcdruid"
      ],
      "name": "Drew Webber (mcdruid)"
    }
  ],
  "details": "The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model\u0027s Markdown response to HTML and stores it for display to privileged users.\n\nThe generated HTML was rendered without passing through Drupal\u0027s filtering pipeline, so it relied on the LLM output being safe. Under certain circumstances a crafted prompt injection \u2014 planted in content that is included in the analysis \u2014 can cause the LLM to emit markup that results in stored Cross-site Scripting when the report is later viewed.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to inject text into the content that is sent to the LLM, and that prompt injection is non-deterministic and not guaranteed to succeed on a given attempt.",
  "id": "DRUPAL-CONTRIB-2026-076",
  "modified": "2026-07-08T17:18:39.000Z",
  "published": "2026-07-08T17:18:39.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-076"
    }
  ],
  "schema_version": "1.7.0"
}

FKIE_CVE-2026-15085

Vulnerability from fkie_nvd - Published: 2026-07-10 22:16 - Updated: 2026-07-10 22:16

Severity

Summary

References

	URL	Tags
	mlhess@drupal.org	https://www.drupal.org/sa-contrib-2026-076

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://www.drupal.org/project/ai_seo",
          "product": "AI SEO/GEO Analyzer",
          "repo": "https://git.drupalcode.org/project/ai_seo",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.1.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3."
    }
  ],
  "id": "CVE-2026-15085",
  "lastModified": "2026-07-10T22:16:41.230",
  "metrics": {},
  "published": "2026-07-10T22:16:41.230",
  "references": [
    {
      "source": "mlhess@drupal.org",
      "url": "https://www.drupal.org/sa-contrib-2026-076"
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "mlhess@drupal.org",
      "type": "Secondary"
    }
  ]
}

GHSA-XG2F-C7H9-QW99

Vulnerability from github – Published: 2026-07-11 00:31 – Updated: 2026-07-11 00:31

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-15085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T22:16:41Z",
    "severity": null
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.",
  "id": "GHSA-xg2f-c7h9-qw99",
  "modified": "2026-07-11T00:31:48Z",
  "published": "2026-07-11T00:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15085"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-076"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-15085 (GCVE-0-2026-15085)

drupal-contrib-2026-076

Vulnerability from drupal

FKIE_CVE-2026-15085

GHSA-XG2F-C7H9-QW99

Tags

Sightings

Nomenclature