CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003
Attackers can trick authenticated users into performing unintended actions in the Drupal AI module, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-31677?
CVE-2025-31677 is a high-severity vulnerability in Drupal AI (Artificial Intelligence), published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.
Weakness: CWE-352
Which versions are affected by CVE-2025-31677?
2 open source packages ship an affected version, including drupal/ai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/ai Packagist | From 1.0.0 | 1.0.2 |
drupal/ai Packagist | From 1.0.0 | 1.0.2 |
Linux distribution packages (1)
drupal/ai Packagist:https://packages.drupal.org/8 | From 1.0.0 | 1.0.2 |
Products include Artificial Intelligence Project Artificial Intelligence.
How do I fix CVE-2025-31677?
Upgrade drupal/ai to 1.0.2 or later.
Is CVE-2025-31677 being exploited?
There is no known exploitation of CVE-2025-31677 in the wild and no public exploit code.
Other vulnerabilities in Drupal AI (Artificial Intelligence)
- CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004
- CVE-2026-3573 AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028
- CVE-2025-31692 AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021
- CVE-2025-31693 AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022
- CVE-2026-13234 Cross-site scripting in AI (Artificial Intelligence)
Sources
Also known as DRUPAL-CONTRIB-2025-003, GHSA-9w85-x5hg-fr66.