—
DRUPAL-CONTRIB-2026-112
상세
The [DXPR Builder](https://www.drupal.org/project/dxpr_builder) module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.
The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via `drupalSettings`.
This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Packagist:https://packages.drupal.org/8 / drupal/dxpr_builder
최초 영향 버전:
0 수정 버전: 2.8.1 Upgrade drupal/dxpr_builder to 2.8.1 or newer (ecosystem packagist:https://packages.drupal.org/8).