| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/ui_icons | ≥ 2.0.0, < 2.0.2< 1.1.3 | 2.0.21.1.3 |
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text.
Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free