DRUPAL-CONTRIB-2026-230: UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
Affected Software
1 affected component
Drupal UI Icons>=0.0.0<=1.1.3, >=2.0.0<=2.0.2
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which release lines are affected?
Affected versions are 0.0.0 through 1.1.3 and 2.0.0 through 2.0.2.
2
Does the available information identify a fixed version?
No fixed version is listed in the provided advisory data. It only identifies the affected version ranges.