CVE-2026-114527: UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
Affected Software
1 affected component
Drupal UI Icons>=0.0.0<=1.1.3, >=2.0.0<=2.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Drupal UI Iconsto a version that resolves this vulnerability.Patch SA-CONTRIB-2026-221
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which UI Icons versions are affected?
Affected versions are 0.0.0 through 1.1.3 and 2.0.0 through 2.0.2.
2
What type of impact does this issue allow?
The issue allows cross-site scripting due to improper neutralization of input during web page generation.