AIKIDO-2026-816313

drupal/search_api_autocomplete is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)CVE-2026-16640 Published Jul 23, 2026

Medium Risk

This Affects:

drupal/search_api_autocomplete

0.0.1 - 1.11.0

Fixed in 1.12.0

Are you affected? Scan for Free

TL;DR

This module adds autocomplete suggestions for Search API search forms. It ships with a test script that is accessible to anonymous users and does not sufficiently validate user input, leading to cross-site scripting. Exploitation is mitigated when the web server is not configured to display PHP warning messages to users.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your PHP or web server configuration displays warning messages to users (for example, with display_errors enabled).

Background info

drupal/search_api_autocomplete is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 1.11.0.

How to fix this

Upgrade the drupal/search_api_autocomplete module to the patch version. If you cannot update immediately, set display_errors: off in php.ini or equivalent settings.