CVE-2025-31693

MediumCVSS 6.6/10Last modified Jul 16, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Drupal	AI (Artificial Intelligence)	>= 0.0.0, < 1.0.5

References

https://www.drupal.org/sa-contrib-2025-022Vendor Advisory

Timeline

Published: Mar 31, 2025
Last modified: Jul 16, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-316948.1Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authe CVE-2025-316956.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatt CVE-2025-316966.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter all CVE-2025-316976.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Si CVE-2025-316987.5ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new settin CVE-2025-316998.9Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client decl CVE-2025-31709.8A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0. This affects an unknown part of CVE-2025-317008.1A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted mali CVE-2025-317018.1A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted mali CVE-2025-317026.8A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploi CVE-2025-317032.4A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a rest CVE-2025-317049.8A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the a