{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-81162","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-81162\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2026-81162\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3281194","id":"3281194","resource":"node"},"field_sa_advisory_id":"112","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/greggles\u0022 rel=\u0022nofollow\u0022\u003EGreg Knaddison (greggles)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:None\/A:None\/CI:Some\/II:None\/E:Theoretical\/TD:Default","field_sa_description":{"value":"\u003Cp\u003EThe \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/dxpr_builder\u0022 rel=\u0022nofollow\u0022\u003EDXPR Builder\u003C\/a\u003E module provides a visual \/ AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.\u003C\/p\u003E\n\u003Cp\u003EThe 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via \u003Ccode class=\u0022language-php\u0022\u003EdrupalSettings\u003C\/code\u003E.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/jurriaanroelofs\u0022 rel=\u0022nofollow\u0022\u003Ejurriaanroelofs\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/jurriaanroelofs\u0022 rel=\u0022nofollow\u0022\u003Ejurriaanroelofs\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the 2.x branch of the DXPR Builder module, upgrade to \u003Ca href=\u0022\/project\/dxpr_builder\/releases\/2.8.1\u0022 rel=\u0022nofollow\u0022\u003EDXPR Builder 2.8.1 or later\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EThe 3.x branch is not affected as it proxies AI requests through the contributed \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/ai\u0022 rel=\u0022nofollow\u0022\u003EAI\u003C\/a\u003E module.\u003C\/li\u003E\n\u003C\/ul\u003E","format":"1"},"field_sa_type":"Information Disclosure","field_issue_last_status_change":"1787766040","field_sa_cve":["CVE-2026-81162"],"field_is_psa":"0","field_affected_versions":"\u003C2.8.1","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3619107","id":"3619107","resource":"node"}],"nid":"3617625","vid":"14473507","is_new":false,"type":"sa","title":"DXPR Builder: The AI Visual  Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2026-112","edit_url":"https:\/\/www.drupal.org\/node\/3617625\/edit","status":"1","promote":"0","sticky":"0","created":"1787766040","changed":"1787766040","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747152","id":16747152,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747153","id":16747153,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16747154","id":16747154,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16748011","id":16748011,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1787766040"}]}