SA-CONTRIB-2026-230: XSS
Published Oct 21, 2026
·Updated
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.
Credit
Jean Valverde (mogtofu33)
Affected Software
1 affected componentFixes available
drupal/ui_icons<2.0.2, <1.1.3
2.0.21.1.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/ui_iconsto a version that resolves this vulnerability.Fixed in 2.0.2Fixed in 1.1.3
Event History
Oct 21, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software