Live › vulnerability › CVE-2026-114527
Drupal UI Icons, a Drupal module for displaying icons, has a cross-site scripting flaw in versions 0.0.0 to 1.1.3 and 2.0.0 to 2.0.2. An attacker can inject script that runs in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the UI Icons module at an affected version. The sources do not describe the exact input path or required role, so whether an anonymous visitor can trigger it is unknown.
No product ranges from the sources yet.
drush pm:list --filter=ui_icons or the Extend page).2.0.2 or after 1.1.3 on its branch, per the sources' ranges (exact fixed version unknown).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114527")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.