CVE-2026-3216

描述

This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers. The project has a hidden sub-module, **Drupal Canvas AI**, which is disabled by default. It is typically enabled as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). When the submodule is enabled, the following vulnerability is exposed. The module doesn't sufficiently sanitize user-supplied data via crafted API requests within the messages JSON payload. It is mitigated by the fact that an attacker must have a role with the permission "use Drupal Canvas AI". **How the Canvas AI sub-module gets enabled:** As a hidden submodule, `canvas_ai` is not intended for manual activation via the UI. It is designed to be pulled in as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush).

如何修補 CVE-2026-3216

要修補 CVE-2026-3216,請將受影響套件升級到下列已修補版本。

• —升級至 1.1.1 或更新版本

CVE-2026-3216 正在被利用嗎?

低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.1.1

CVSS 分數

參考連結(1)

• WEBwww.drupal.org/sa-contrib-2026-017