Ui icons: This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. (CVE-2026-114532)

The UI Icons module for Drupal provides a user interface to select and configure icons, including integration with CKEditor 5. A Cross-site scripting (XSS) vulnerability exists when the CKEditor 5 widget displays admin-controlled text without adequate filtering under uncommon conditions. This vulnerability requires the attacker to have content editing permissions with a text format that allows the UI Icons CKEditor 5 button. The affected versions are prior to 1.1.3 and versions from 2.0.0 up to but not including 2.0.2. A patch is available to address this issue.

Successful exploitation of this vulnerability could allow an attacker with content editing permissions to inject malicious scripts via the CKEditor 5 widget, potentially leading to XSS attacks. However, the requirement for editing privileges and specific text format usage limits the scope of impact.

A patch is available for this vulnerability. Users should upgrade to versions 1.1.3 or later, or 2.0.2 or later, to remediate the issue. Since the vulnerability requires specific editing permissions and text format configurations, restricting these permissions can also reduce risk.