{"id":"CVE-2026-114527","kind":"vulnerability","aliases":["CVE-2026-114527"],"related":[],"title":"Drupal UI Icons: cross-site scripting flaw lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.","summary":"Drupal UI Icons, a Drupal module for displaying icons, has a cross-site scripting flaw in versions 0.0.0 to 1.1.3 and 2.0.0 to 2.0.2. An attacker can inject script that runs in a visitor's browser.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php"],"not_affected_if":["module-not-installed","unaffected-version"],"how_to_check":"- Check the installed UI Icons version in the Drupal site (for example `drush pm:list --filter=ui_icons` or the Extend page).\n- Confirm whether the module is enabled on the site.","fix":"- UI Icons: move to a version after `2.0.2` or after `1.1.3` on its branch, per the sources' ranges (exact fixed version unknown).","status":"open","published_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:09+00:00","updated_at":"2026-10-30T04:31:09+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:09Z","model":"claude-haiku-5-5","output":{"fix":"- UI Icons: move to a version after `2.0.2` or after `1.1.3` on its branch, per the sources' ranges (exact fixed version unknown).","reach":"internet","title":"Drupal UI Icons: cross-site scripting flaw lets attackers run scripts in pages","impact":"medium","summary":"Drupal UI Icons, a Drupal module for displaying icons, has a cross-site scripting flaw in versions 0.0.0 to 1.1.3 and 2.0.0 to 2.0.2. An attacker can inject script that runs in a visitor's browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the affected site","analyst_note":"Find the Drupal security advisory for UI Icons to confirm the fixed version, the vulnerable input path, and whether authentication is needed.","how_to_check":"- Check the installed UI Icons version in the Drupal site (for example `drush pm:list --filter=ui_icons` or the Extend page).\n- Confirm whether the module is enabled on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed","unaffected-version"],"who_is_affected":"Drupal sites that run the UI Icons module at an affected version. The sources do not describe the exact input path or required role, so whether an anonymous visitor can trigger it is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4132,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114527':17A,20A '-2026':16A,19A '0.0.0':42B,91C '1.1.3':44B,93C '2.0.0':46B,95C '2.0.2':48B,97C 'affect':86C 'allow':78C 'attack':10A,50B 'browser':60B 'cross':5A,36B,70C,80C 'cross-sit':4A,35B,69C,79C 'cve':15A,18A 'display':31B 'drupal':1A,21B,24B,28B,75C 'flaw':8A,39B 'generat':68C 'icon':3A,26B,32B,77C,88C 'improp':61C 'inject':52B 'input':64C 'issu':85C 'let':9A 'modul':29B 'neutral':62C 'packag':22B 'page':14A,67C 'php':23B 'run':11A,55B 'script':7A,12A,38B,53B,72C,82C 'site':6A,37B,71C,81C 'ui':2A,25B,76C,87C 'version':41B,89C 'visitor':58B 'vulner':73C 'web':66C 'xss':83C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the UI Icons module at an affected version. The sources do not describe the exact input path or required role, so whether an anonymous visitor can trigger it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114527","severity":null,"published_at":"2026-10-30T04:18:11+00:00","modified_at":"2026-10-30T04:18:11+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}