---
id: CVE-2026-87936
title: amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
summary: >-
  Improper Neutralization of Special Elements used in an SQL Command ('SQL
  Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL
  Injection. This issue affects amazee.ai Private AI Provider versions: from
  0.0.0 to 1.3…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-89
vendor: Drupal
product: amazee.ai Private AI Provider
affected:
  - amazee.ai_private_ai_provider >= 0.0.0 < 1.3.7
  - amazee.ai_private_ai_provider >= 1.4.0 < 1.4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-22T17:18:53.248356Z'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T17:18:56.762Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-87936'
references:
  - url: 'https://www.drupal.org/sa-contrib-2026-134'
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.193Z'
epss: 0.00273
epssPercentile: 0.19569
---

## Overview

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

## Affected

- `amazee.ai_private_ai_provider >= 0.0.0 < 1.3.7`
- `amazee.ai_private_ai_provider >= 1.4.0 < 1.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.