PatchClock

PHP security digest · 21 Oct 2026

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn'...

Unrated CVE-2026-114527

Package
drupal/ui_icons
Fixed in
1.1.3, 2.0.2
Published
Wed 21 Oct 2026, 18:36 LisbonUpdated Mon 26 Oct 2026, 07:26 Lisbon

In plain words

The module does not sufficiently validate icon settings supplied by users before rendering them. This can allow insufficiently validated settings to be rendered, but the advisory does not state the resulting security impact.

Am I affected?

Find drupal/ui_icons and its version in composer.lock. The advisory lists 1.1.3 and 2.0.2 as fixed versions but gives no affected version range. The flaw concerns rendering user-provided icon settings; no specific configuration, integration or database condition is named.

What to do

Check which version you have, then update to a fixed release for your branch (1.1.3, 2.0.2):

composer show drupal/ui_icons | grep versions
composer update drupal/ui_icons

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations.

The module doesn't sufficiently validate icon settings provided by users before they are rendered.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.