SA-CONTRIB-2026-221: Critical severity drupal/ui_icons vulnerability

Q: Which sites should treat this as immediately relevant?

Sites that let users provide icon settings and render those settings are the directly affected exposure case described. The affected module includes a form element, a text format filter, and several integrations.

Q: What capability does an attacker need?

An attacker needs a way to provide icon settings that will later be rendered. The available information does not specify whether authentication or a particular privilege level is required.

Published Oct 21, 2026

Updated

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn't sufficiently validate icon settings provided by users before they are rendered.

Credit

André Angelantoni (aangel), Octavio Galland (ogalland-tob)

Affected Software

1 affected componentFixes available

drupal/ui_icons<2.0.2, <1.1.3

2.0.21.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/ui_icons to a version that resolves this vulnerability.
Fixed in 2.0.2Fixed in 1.1.3

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114527

Frequently Asked Questions

Which sites should treat this as immediately relevant?

Sites that let users provide icon settings and render those settings are the directly affected exposure case described. The affected module includes a form element, a text format filter, and several integrations.

What capability does an attacker need?

An attacker needs a way to provide icon settings that will later be rendered. The available information does not specify whether authentication or a particular privilege level is required.

SA-CONTRIB-2026-221: Critical severity drupal/ui_icons vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which sites should treat this as immediately relevant?

What capability does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which sites should treat this as immediately relevant?

What capability does an attacker need?