Cross-Site Scripting Vulnerability in Drupal UI Icons
CVE-2026-114527

Currently unrated

Key Information:

Vendor

Drupal
Status
Ui Icons
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114527?

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal UI Icons component due to improper neutralization of user input during web page generation. This flaw allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized access and data theft. The vulnerability affects UI Icons across several versions, specifically from 0.0.0 to 1.1.3, and from 2.0.0 to 2.0.2. Users are encouraged to apply the necessary updates to mitigate this security risk.

Affected Version(s)

UI Icons 0.0.0 < 1.1.3

UI Icons 2.0.0 < 2.0.2

References

https://www.drupal.org/sa-contrib-2026-221

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

André Angelantoni (aangel)
Octavio Galland (ogalland-tob)
Jean Valverde (mogtofu33)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Dave Long (longwave)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
.