Vulnerability DRUPAL-CONTRIB-2026-010
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 months ago
February 11, 2026 at 04:54 PM UTC
No summary available
<1.0.1, >=1.1.0 <1.1.1
<1.0.1, >=1.1.0 <1.1.1
Details
This module enables you to integrate and manage icons with Drupal.
The module doesn't sufficiently sanitize user input leading to a reflected Cross-site Scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact that in order to be vulnerable, the "UI Icons for CKEditor 5" submodule must be enabled.
Note: this SA was edited after release to correct the risk score; there is no user authentication requirement.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 hours ago
No summary available
<1.1.3, >=2.0.0 <2.0.2 DRUPAL-CONTRIB-2026-230
<1.1.3, >=2.0.0 <2.0.2 DRUPAL-CONTRIB-2026-230
Unknown
3 hours ago
No summary available
<1.1.3, >=2.0.0 <2.0.2 DRUPAL-CONTRIB-2026-221
<1.1.3, >=2.0.0 <2.0.2 DRUPAL-CONTRIB-2026-221
Impacted packages
Timeline
Published
8 months ago
February 11, 2026 at 04:54 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:46 AM UTC