CVE-2026-3216 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers. The project has a hidden sub-module, Drupal Canvas AI, which is disabled by default. It is typically enabled as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). When the submodule is enabled, the following vulnerability is exposed. The module doesn't sufficiently sanitize user-supplied data via crafted API requests within the messages JSON payload. It is mitigated by the fact that an attacker must have a role with the permission "use Drupal Canvas AI". How the Canvas AI sub-module gets enabled: As a hidden submodule, canvas_ai is not intended for manual activation via the UI. It is designed to be pulled in as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush).
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.