All vulnerabilities
CVE-2026-87936

amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Drupal amazee.ai Private AI ProviderApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.3.7Also 1.4.3CVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 1.3.7amazee.ai Private AI ProviderCVE List
  • 1.4.3amazee.ai Private AI ProviderCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

Text from CVE List

Affected versions 2

  • amazee.ai Private AI Provideraffected: 0.0.0 before 1.3.7CVE List
  • amazee.ai Private AI Provideraffected: 1.4.0 before 1.4.3CVE List

References 1