CVE-2026-114532: UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
Affected Software
1 affected component
Drupal UI Icons>=0.0.0<=1.1.3, >=2.0.0<=2.0.2
Event History
Oct 30, 2026
CVE Published
via MITRE·03:09 AM
Data Sourced
via MITRE·03:09 AM
DescriptionWeakness
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
DescriptionWeakness
Nov 6, 2026
Data Sourced
via NVD·04:17 PM
Severity
Frequently Asked Questions
1
Which UI Icons installations are affected?
Affected versions are 0.0.0 through 1.1.3 and 2.0.0 through 2.0.2. The provided information does not identify unaffected fixed versions.
2
What type of attack does this issue enable?
The issue allows cross-site scripting because input is not properly neutralized during web page generation. The provided information does not state the required attacker privileges, exploitation path, or whether default configurations are affected.