CVE-2026-114532 Drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess exposure, especially those allowing content editing with the UI Icons CKEditor 5 button enabled. They must verify if their Drupal deployment uses the UI Icons module and allows content editing with the CKEditor 5 button enabled. Additionally, they should review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and remediation efforts.

Why it matters

CVE-2026-114532 is a Cross-site scripting (XSS) vulnerability in the UI Icons module for Drupal. Defenders should verify exposure, prioritize updates for affected versions, and restrict access to mitigate potential XSS risks.

• Potential XSS attacks through admin-controlled text in the CKEditor 5 widget.
• Need to verify exposure in Drupal deployments using the UI Icons module.
• Prioritize updating affected versions of the UI Icons module.
• Restrict access to content editing features that allow the UI Icons CKEditor 5 button.

Technical summary

The UI Icons module for Drupal provides a CKEditor 5 button and widget to embed icons in formatted text. A Cross-site scripting (XSS) vulnerability occurs under uncommon situations when the CKEditor 5 widget displays admin-controlled text with appropriate filtering. An attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button to exploit this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure in their Drupal deployments that use the UI Icons module, especially those allowing content editing with the CKEditor 5 button enabled.

Recommended defensive actions

• Verify if your Drupal deployment uses the UI Icons module and allows content editing with the CKEditor 5 button enabled.
• Check if your version of the UI Icons module is <1.1.3 or >=2.0.0 <2.0.2 and consider updating to a fixed version.
• Restrict access to content editing features that allow the UI Icons CKEditor 5 button to mitigate potential XSS risks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability details are based on the Drupal Security Team's advisory and the CVE Program record. The affected versions are <1.1.3 and >=2.0.0 <2.0.2. However, specific version details and comprehensive impact assessments are limited in the provided source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.