Ui Icons CVE-2026-2349

Without a published CVSS vector, EPSS score, or CVSS base score, quantitative risk assessment is limited; however, qualitative signals indicate moderate to significant real-world risk. XSS vulnerabilities (CWE-79) are consistently among the most exploitable and damaging web application flaws, with low attack complexity and network-based attack vectors. The fact that Drupal—a high-profile open-source CMS—officially reported this issue suggests active discovery and likely rapid public awareness. The dual-version range (two separate branches affected) indicates the vulnerability may be present in both legacy and recent code paths. The absence of automated exploitation data and the requirement for specific user interaction or configuration typical of UI icon modules suggest this is not a fully autonomous, worm-capable exploit, but remains easily exploitable by human attackers and likely automatable with minor customization.

An attacker crafts a malicious icon configuration or UI element containing embedded JavaScript (e.g., <img src=x onerror=alert('xss')>) and either submits it directly via an admin form or tricks an administrator into importing a compromised configuration file. When the UI Icons module renders the icon in a web page without proper escaping, the attacker's JavaScript executes in the context of the victim's browser, potentially stealing session cookies, redirecting to phishing pages, or modifying page content. The attack requires either direct access to configuration interfaces or social engineering of a trusted user, but once triggered, the payload executes with the privileges of the logged-in user.