Ui icons: This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. (CVE-2026-114527)

CVE-2026-114527 affects the Drupal UI Icons module, which provides a user interface for selecting and configuring icons, including form elements and text format filters. The vulnerability arises because the module does not sufficiently validate icon settings submitted by users before rendering them. This lack of validation may allow malicious input to be processed, potentially leading to security risks. The affected versions are those before 1.1.3 and versions from 2.0.0 up to but not including 2.0.2. A patch is available to fix this vulnerability.

The vulnerability could allow attackers to submit crafted icon settings that bypass validation, potentially leading to security issues such as injection or rendering of malicious content. However, no known exploits are reported in the wild at this time.

A patch is available for the affected versions of the Drupal UI Icons module. Users should update to version 1.1.3 or later, or to version 2.0.2 or later to remediate this vulnerability.