The Drupal UI Icons component contains an Improper Neutralization of Input During Web Page Generation vulnerability that allows Cross‑Site Scripting. An attacker may inject malicious script code into icon metadata that is rendered into browsers without proper escaping, enabling the execution of arbitrary JavaScript within the victim’s browsing context.

Drupal UI Icons is vulnerable in all releases from version 0.0.0 through 1.1.3 and from 2.0.0 through 2.0.2. Administrators using these or earlier releases should verify the installed module version and assess exposure.

The CVSS score is not published and EPSS information is unavailable, indicating no public metrics for risk severity. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not been widely observed in large‑scale exploitation. Based on the description, it is inferred that the likely attack vector is the web interface, where malicious icon data can be submitted and rendered without proper sanitization; both authenticated and unauthenticated users could be affected depending on their ability to submit data.