drupal/canvas - SA-CONTRIB-2026-017
This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers.
The project has a hidden sub-module, Drupal Canvas AI, which is disabled by default. It is typically enabled as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). When the submodule is enabled, the following vulnerability is exposed.
The module doesn't sufficiently sanitize user-supplied data via crafted API requests within the messages JSON payload.
It is mitigated by the fact that an attacker must have a role with the permission "use Drupal Canvas AI".
How the Canvas AI sub-module gets enabled: As a hidden submodule, canvas_ai is not intended for manual activation via the UI. It is designed to be pulled in as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/canvas | < 1.1.1 | 1.1.1 |
| Drupal module | drupal/canvas | < 1.1.1 | 1.1.1 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/canvas- Disclosed
- 25.02.2026
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2026-017 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/canvas
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 01.2026 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Unrated 4
Disclosures per year
- 2026: 4
-
drupal/canvas - SA-CONTRIB-2026-017 this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.