AIKIDO-2026-154302
drupal/smartlinker_ai is vulnerable to Information Disclosure
50
Medium Risk
This Affects:
drupal/smartlinker_aiTL;DR
The SmartLinker AI module adds a Generate internal links action to the AI CKEditor toolbar so editors can search the site for pages to link to. Affected versions do not enforce entity access on that search, so results returned to the browser can include content the current user is not allowed to view. Exploitation requires permission to use the Generate internal links feature on a text format.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a user can use the Generate internal links feature on a text format.
Background info
drupal/smartlinker_ai is vulnerable to Information Disclosure in versions 1.0.0 - 1.0.2.
How to fix this
Upgrade the drupal/smartlinker_ai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.