| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/ui_icons | ≥ 1.1.0, < 1.1.1< 1.0.1 | 1.1.11.0.1 |
| ui icons | = 1.1.0< 1.0.1 | 1.0.1 |
This module enables you to integrate and manage icons with Drupal.
The module doesn't sufficiently sanitize user input leading to a reflected Cross-site Scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact that in order to be vulnerable, the "UI Icons for CKEditor 5" submodule must be enabled.
Note: this SA was edited after release to correct the risk score; there is no user authentication requirement.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free