Project:
Project machine name:
ui_iconsDate:
2026-October-21
Vulnerability:
Cross site scripting
Affected versions:
<1.1.3 || >=2.0.0 <2.0.2
CVE IDs:
CVE-2026-114527
Description:
This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations.
The module doesn't sufficiently validate icon settings provided by users before they are rendered.
Solution:
Install the latest version:
- If you use the UI Icons 2.0.x module, upgrade to UI Icons 2.0.2
- If you use the UI Icons 1.1.x module, upgrade to UI Icons 1.1.3
UI Icons 1.0.x is not supported. Sites using it should upgrade to UI Icons 1.1.3 or 2.0.2.
Reported By:
Fixed By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
