This vulnerability (CVE-2026-15084) in Drupal UI Patterns (SDC in Drupal UI) versions 2.0.0 through 2.0.17 involves improper neutralization of input during web page generation, leading to stored cross-site scripting (CWE-79). An attacker with low privileges and requiring user interaction can inject malicious scripts that execute in the security context of other users, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows an attacker with low privileges to inject persistent malicious scripts into web pages generated by the Drupal UI Patterns module. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens, or manipulation of displayed content. There is no impact on system availability. The vulnerability requires user interaction and affects the security scope beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected module or disabling it if feasible. Monitor Drupal security channels for updates and apply patches promptly once released.