—
DRUPAL-CONTRIB-2026-010
Details
This module enables you to integrate and manage icons with Drupal.
The module doesn't sufficiently sanitize user input leading to a reflected Cross-site Scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact that in order to be vulnerable, the "UI Icons for CKEditor 5" submodule must be enabled.
*Note: this SA was edited after release to correct the risk score; there is no user authentication requirement.*
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/ui_icons
Introduced in:
0Fixed in: 1.0.1Upgrade drupal/ui_icons to 1.0.1 or newer (ecosystem packagist:https://packages.drupal.org/8).