PatchClock

PHP security digest · 21 Oct 2026

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncom...

Unrated CVE-2026-114532

Package
drupal/ui_icons
Fixed in
1.1.3, 2.0.2
Published
Wed 21 Oct 2026, 18:44 LisbonUpdated Mon 26 Oct 2026, 07:25 Lisbon

In plain words

In uncommon situations, the UI Icons CKEditor 5 widget can cause cross-site scripting (XSS) when displaying admin-controlled text. An attacker must have access to edit content using a text format that allows the UI Icons CKEditor 5 button.

Am I affected?

Find drupal/ui_icons and its version in composer.lock. The advisory lists fixes in 1.1.3 and 2.0.2, but gives no affected version ranges. Check whether a text format allows the UI Icons CKEditor 5 button and who has access to edit content using that format.

What to do

Check which version you have, then update to a fixed release for your branch (1.1.3, 2.0.2):

composer show drupal/ui_icons | grep versions
composer update drupal/ui_icons

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by requiring an attacker to have access to edit content with a text format that allows the UI Icons CKEditor 5 button.

The advisory's description

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text.

Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.