Drupal UI Icons contains an improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts that run in the browsers of site visitors. Attackers can exploit the vulnerability by submitting specially crafted icon data that is rendered without adequate escaping. The flaw is classified as a classic reflected or stored XSS vulnerability (CWE‑79), which can compromise user credentials, deface the site, or serve malware.

The issue affects the Drupal UI Icons module, specifically versions 0.0.0 through 1.1.3 and 2.0.0 through 2.0.2. All installations of these module releases that expose icon data to users are potentially vulnerable until remediation.

The vulnerability is listed as moderately critical and is not present in CISA’s KEV catalog. No EPSS score is available, so the likelihood of exploitation cannot be precisely quantified; however, XSS flaws are commonly leveraged by attackers through social engineering or automated scripts. The risk is moderate due to the potential impact on confidentiality and integrity of users interacting with the affected module.