OpenAI Provider security updates, in plain English

OpenAI Provider

15,737 sites report using it · on drupal.org · 1 security update explained here

This module allows the website to use OpenAI models for text generation and image creation.

Below is every security update for OpenAI Provider that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

OpenAI Provider

Moderately critical · 15,737 sites report using it · SA-CONTRIB-2026-053 · on drupal.org · Week of 24 June 2026

An administrator account could supply a malicious web address to force the server to make unsafe requests. They could view restricted server responses and alter specific image generation settings. They could not access or modify every piece of information on the website.

Who could do thisOnly someone with an administrator login.
Does it apply to youA site is affected if an attacker has the access right to change the host web address and a way to create artificial intelligence images.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate OpenAI Provider to 1.1.1 or 1.2.2, whichever branch you are on.

For developers: what the fix changed

The fix removes the ability to fetch generated images via URL using `file_get_contents()` in `OpenAiProvider::generateImage()`, instead forcing the API to return base64-encoded image data directly. This prevents the server from making arbitrary requests to potentially malicious URLs.

Also in this release The release also deprecates Dall-E 3 in favour of GPT Image models, updates API key validation, adds host configuration support, and updates model capabilities and defaults.

1.1.0 to 1.1.1 9 commits, 8 files.

.cspell-project-words.txt +1 −2
ai_provider_openai.install +23 −0
ai_provider_openai.services.yml +1 −1
definitions/api_defaults.yml +11 −14
src/Form/OpenAiConfigForm.php +15 −5
src/OpenAiChatMessageIterator.php +2 −1
src/OpenAiHelper.php +15 −1
src/Plugin/AiProvider/OpenAiProvider.php +110 −75 fix

Full diff, 1.1.0 to 1.1.1 · Full diff, 1.2.1 to 1.2.2

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK charities, membership bodies and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

OpenAI Provider

OpenAI Provider

Send me your Drupal site's address.

Get in touch

Links

Reference