CVE-2026-2349

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2349", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-02-11T15:48:45.648Z", "datePublished": "2026-03-25T15:21:28.488Z", "dateUpdated": "2026-03-25T20:03:40.679Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-25T15:21:28.488Z"}, "title": "UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010", "datePublic": "2026-02-11T16:54:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"vendor": "Drupal", "product": "UI Icons", "collectionURL": "https://www.drupal.org/project/ui_icons", "repo": "https://git.drupalcode.org/project/ui_icons", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.0.1", "versionType": "semver"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).<p>This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.</p>"}]}], "references": [{"url": "https://www.drupal.org/sa-contrib-2026-010"}], "credits": [{"lang": "en", "value": "Drew Webber (mcdruid)", "type": "finder"}, {"lang": "en", "value": "Jean Valverde (mogtofu33)", "type": "remediation developer"}, {"lang": "en", "value": "Greg Knaddison (greggles)", "type": "coordinator"}, {"lang": "en", "value": "Drew Webber (mcdruid)", "type": "coordinator"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T20:03:26.630487Z", "id": "CVE-2026-2349", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T20:03:40.679Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-2349", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T20:03:26.630487Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T20:03:37.158Z"}}], "cna": {"title": "UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "remediation developer", "value": "Jean Valverde (mogtofu33)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/ui_icons", "vendor": "Drupal", "product": "UI Icons", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.0.1", "versionType": "semver"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.1", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/ui_icons", "defaultStatus": "unaffected"}], "datePublic": "2026-02-11T16:54:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-010"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).<p>This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-25T15:21:28.488Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2349", "state": "PUBLISHED", "dateUpdated": "2026-03-25T20:03:40.679Z", "dateReserved": "2026-02-11T15:48:45.648Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-03-25T15:21:28.488Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.drupal.org/project/ui_icons", "defaultStatus": "unaffected", "product": "UI Icons", "repo": "https://git.drupalcode.org/project/ui_icons", "vendor": "Drupal", "versions": [{"lessThan": "1.0.1", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "1.1.1", "status": "affected", "version": "1.1.0", "versionType": "semver"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:beyris:ui_icons:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "98735D06-2908-439E-8BD9-8BBDAE2B8F12", "versionEndExcluding": "1.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:beyris:ui_icons:1.1.0:*:*:*:*:drupal:*:*", "matchCriteriaId": "57539085-2E34-406E-9A78-E3D57E7DDE5B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1."}, {"lang": "es", "value": "La vulnerabilidad de Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') en Drupal UI Icons permite cross-site scripting (XSS). Este problema afecta a UI Icons: desde 0.0.0 anterior a 1.0.1, desde 1.1.0 anterior a 1.1.1."}], "id": "CVE-2026-2349", "lastModified": "2026-06-17T10:30:49.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2349", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T20:03:26.630487Z", "version": "2.0.3"}}]}, "published": "2026-03-25T16:16:21.660", "references": [{"source": "mlhess@drupal.org", "tags": ["Vendor Advisory"], "url": "https://www.drupal.org/sa-contrib-2026-010"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "mlhess@drupal.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,1.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.0,1.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "UI Icons", "source": "cna", "vendor": "Drupal"}, "product": "ui_icons", "vendor": "drupal"}], "analysis": {"en": {"generated_at": "2026-04-01T06:50:14.837462+00:00", "value": {"mitigation_remediation": ["Upgrade Drupal UI Icons to version\u202f1.0.1 or later, or to version\u202f1.1.1 or later.", "If an upgrade cannot be performed immediately, uninstall or disable the UI Icons module to block potential exploitation."], "summary": {"action": "Patch Now", "impact": "Cross\u2011site scripting"}, "threat_synthesis": {"affected_systems": "Drupal UI Icons is affected. Versions from the initial release through the end of 1.0.0, and again from 1.1.0 up to the end of 1.1.0, contain the vulnerability. Any system running one of those versions should be considered at risk.", "description_and_impact": "Improper neutralization of user input in the Drupal UI Icons module allows an attacker to inject arbitrary JavaScript code into web pages rendered with that module. A successful injection could lead to session hijacking, information disclosure, defacement, or redirecting users to malicious sites. The underlying weakness is a classic cross\u2011site scripting flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1\u202f% suggests the vulnerability is unlikely to be widely exploited in the near term. It is not listed in the CISA known exploited vulnerabilities catalog. Attackers can exploit the flaw remotely by submitting malicious payloads in input that is processed by the UI Icons component; the most likely vector is web\u2011based user input, though the exact details are not specified in the advisory. "}}}}, "created": "2026-03-25T21:48:05.124596+00:00", "updated": "2026-04-02T07:59:15.741833+00:00", "vendors": ["drupal", "drupal$PRODUCT$ui_icons"]}