PT-2026-7808

CVE-2026-2349

Publicado

2026-02-11

Atualizado

2026-03-25

Descrição por

CVSS 3.1

6.1

Média

MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal UI Icons versions prior to 1.0.1 Drupal UI Icons version 1.1.0 before 1.1.1

Description A flaw exists in Drupal UI Icons that allows for Cross-Site Scripting (XSS). The issue stems from insufficient sanitization of user input during web page generation. The vulnerability is present when the "UI Icons for CKEditor 5" submodule is enabled.

Recommendations Update Drupal UI Icons to version 1.0.1 or later. Update Drupal UI Icons to version 1.1.1 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Drew Webber

Greg Knaddison

Jean Valverde

Fornecedores

Produtos afetados

Enumeração de fraquezas