CVE-2026-114532

Name of the Vulnerable Software and Affected Versions Drupal UI Icons versions 0.0.0 through 1.1.3 Drupal UI Icons versions 2.0.0 through 2.0.2

Description Improper neutralization of input during web page generation leads to Cross-site Scripting (XSS) in the CKEditor 5 widget. This occurs when the widget displays admin-controlled text with insufficient filtering. Exploitation requires the attacker to have permissions to edit content using a text format that enables the UI Icons CKEditor 5 button.

Recommendations Update Drupal UI Icons versions 0.0.0 through 1.1.3 to a version newer than 1.1.3. Update Drupal UI Icons versions 2.0.0 through 2.0.2 to a version newer than 2.0.2.