DRUPAL-CONTRIB-2026-221: UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
Affected Software
1 affected component
Drupal UI Icons>=0.0.0<=1.1.3, >=2.0.0<=2.0.2
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which UI Icons releases are affected?
Affected versions are 0.0.0 through 1.1.3 and 2.0.0 through 2.0.2.
2
Does exploiting this issue require authentication or user interaction?
The vector indicates network exploitation with low attack complexity and no privileges required. Exploitation does require user interaction.
3
What impact can successful exploitation have?
The issue is an XSS vulnerability with low confidentiality, integrity, and availability impact, and its scope is changed.