CVE-2026-3218

MEDIUM 4.8CVE-2026-3218 · DRUPAL-CONTRIB-2026-019 · Published 25/03/2026 · updated 17/06/2026

In short

CVE-2026-3218 is a MEDIUM (CVSS 4.8) vulnerability affecting drupal/responsive_favicons, responsive favicons (pixelite).
Chance of exploitation in the next 30 days (EPSS): 0.19%, higher than 8.4% of all vulnerabilities.
Fix: update to 2.0.2 or later.

Package	Affected versions	Patched versions
drupal/responsive_favicons Packagist:https://packages.drupal.org/8	`< 2.0.2`	`2.0.2`
responsive favicons pixelite	`< 2.0.2`	`2.0.2`

Description

This module adds the favicons generated by realfavicongenerator.net to your Drupal site.

The module does not filter administrator-entered text, leading to a persistent Cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer responsive favicons".

NVD description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.

References

drupal.org/sa-contrib-2026-019 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free