---
id: CVE-2026-87936
title: amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
summary: >-
  Improper Neutralization of Special Elements used in an SQL Command ('SQL
  Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL
  Injection. This issue affects amazee.ai Private AI Provider versions: from
  0.0.0 to 1.3…
severity: none
cwe:
  - CWE-89
vendor: Drupal
product: amazee.ai Private AI Provider
affected:
  - amazee.ai_private_ai_provider >= 0.0.0 < 1.3.7
  - amazee.ai_private_ai_provider >= 1.4.0 < 1.4.3
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T01:22:05.298Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-87936'
references:
  - url: 'https://www.drupal.org/sa-contrib-2026-134'
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.193Z'
---

## Overview

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

## Affected

- `amazee.ai_private_ai_provider >= 0.0.0 < 1.3.7`
- `amazee.ai_private_ai_provider >= 1.4.0 < 1.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.