CVE-2025-31692
Published: 31 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-31692 is an OS Command Injection vulnerability (CWE-78) in the Drupal AI (Artificial Intelligence) module, stemming from improper neutralization of special elements used in OS commands. This flaw affects all versions of the module from 0.0.0 up to but not including 1.0.5. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high potential impact despite elevated attack complexity.
A low-privileged user (PR:L) can exploit this over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H) and does not change scope (S:U). Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability (C:I:A:H), enabling arbitrary OS command execution on the hosting server.
The Drupal security advisory at https://www.drupal.org/sa-contrib-2025-021 details the issue and mitigation, recommending an upgrade to Drupal AI version 1.0.5 or later to address the vulnerability.
This vulnerability is notable for affecting a Drupal module specifically designed for artificial intelligence functionalities, highlighting potential risks in AI-integrated web applications. No public information on real-world exploitation is available as of the CVE publication on 2025-03-31.
Details
- CWE(s)
Affected Products
AI Security Analysis
- AI Category
- Other Platforms
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- MITRE ATLAS Techniques
- None mapped
- Classification Reason
- The vulnerability affects 'Drupal AI (Artificial Intelligence)', a module for the Drupal CMS platform that integrates AI capabilities, fitting under 'Other Platforms' as it is a web/content management platform extension for AI rather than a core DL/ML framework or specific AI subdomain.
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The OS Command Injection vulnerability in the Drupal AI module enables exploitation of a public-facing web application (T1190) and arbitrary OS command execution via command and scripting interpreters (T1059).