Improper neutralization of user input in the Drupal UI Icons module allows an attacker to inject arbitrary JavaScript code into web pages rendered with that module. A successful injection could lead to session hijacking, information disclosure, defacement, or redirecting users to malicious sites. The underlying weakness is a classic cross‑site scripting flaw (CWE‑79).

Drupal UI Icons is affected. Versions from the initial release through the end of 1.0.0, and again from 1.1.0 up to the end of 1.1.0, contain the vulnerability. Any system running one of those versions should be considered at risk.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1 % suggests the vulnerability is unlikely to be widely exploited in the near term. It is not listed in the CISA known exploited vulnerabilities catalog. Attackers can exploit the flaw remotely by submitting malicious payloads in input that is processed by the UI Icons component; the most likely vector is web‑based user input, though the exact details are not specified in the advisory.