{"id":"CVE-2026-2349","published":"2026-03-25T15:21:28Z","modified":"2026-03-25T20:03:40Z","title":"UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010","vendor":"Drupal","product":"UI Icons","tier":"tail","description":{"text":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00155,"percentile":0.04559,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-010","tags":[]}],"priority":{"score":5.2,"factors":[{"name":"EPSS percentile","points":0.91},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"drupal","affectedVersions":[{"vendor":"Drupal","product":"UI Icons","versions":[">= 0.0.0, < 1.0.1",">= 1.1.0, < 1.1.1"]}],"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ui_icons","vulnerableRanges":["<1.0.1",">=1.1.0, <1.1.1"],"patched":["1.0.1","1.1.1"],"from":["DRUPAL-CONTRIB-2026-010"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-15453","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-drupal-ui-icons-cve-2026-2349","packageHistory":[{"cve":"CVE-2026-2349","published":"2026-03-25","fixed":"1.1.1","kev":false},{"cve":"CVE-2026-114527","published":"2026-10-30","fixed":"2.0.2","kev":false,"link":{"from":"CVE-2026-2349","to":"CVE-2026-114527","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:https://packages.drupal.org/8:drupal/ui_icons","fromFixed":"1.1.1","toFixed":"1.1.3","daysApart":219},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-114532","published":"2026-10-30","fixed":"2.0.2","kev":false,"link":{"from":"CVE-2026-2349","to":"CVE-2026-114532","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:https://packages.drupal.org/8:drupal/ui_icons","fromFixed":"1.1.1","toFixed":"1.1.3","daysApart":219},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}}],"package":"Packagist:https://packages.drupal.org/8:drupal/ui_icons"}}