PT-2026-120902

CVE-2026-114527

Published

2026-10-21

Updated

2026-10-30

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Drupal UI Icons versions 0.0.0 through 1.1.3 Drupal UI Icons versions 2.0.0 through 2.0.2

Description Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently validate icon settings provided by users before they are rendered.

Recommendations Update Drupal UI Icons versions 0.0.0 through 1.1.3 to a version newer than 1.1.3. Update Drupal UI Icons versions 2.0.0 through 2.0.2 to a version newer than 2.0.2.

Exploitability

Exploit

Fix

Impacts

Researchers