[IT-SecNots] [Security-news] UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-075

Project: UI Patterns (SDC in Drupal UI) [1]
Date: 2026-July-08
Security risk: *Moderately critical* 14 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross site scripting

Affected versions: <2.0.17
CVE IDs: CVE-2026-15084
Description: 
This module enables you to use Single Directory Components in site building
(views, field formatters, blocks, layouts) and it improves the Developer
Experience (DX) with SDC.

The module doesn't sufficiently sanitize the markup passed to components
under certain scenarios.

This vulnerability is mitigated by the fact that an attacker must be able to
create or update content rendered by UI Patterns.

Solution: 
Install the latest version:

 * If you use the UI Patterns module on version 2, upgrade to UI Patterns
   2.0.17 [3]

Reported By: 
 * Hervé Donner (herved) [4]

Fixed By: 
 * Florent Torregrosa (grimreaper) [5]
 * Hervé Donner (herved) [6]
 * Mikael Meulle (just_like_good_vibes) [7]
 * Pierre Dureau (pdureau) [8]

Coordinated By: 
 * Neil Drumm (drumm) [9] of the Drupal Security Team
 * Greg Knaddison (greggles) [10] of the Drupal Security Team
 * Juraj Nemec (poker10) [11] of the Drupal Security Team
 * Dave Long (longwave) [12] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_items/1
[13]
------------------------------------------------------------------------------
Contribution record [14]

[1] https://www.drupal.org/project/ui_patterns
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ui_patterns/releases/2.0.17
[4] https://www.drupal.org/u/herved
[5] https://www.drupal.org/u/grimreaper
[6] https://www.drupal.org/u/herved
[7] https://www.drupal.org/u/just_like_good_vibes
[8] https://www.drupal.org/u/pdureau
[9] https://www.drupal.org/u/drumm
[10] https://www.drupal.org/u/greggles
[11] https://www.drupal.org/u/poker10
[12] https://www.drupal.org/u/longwave
[13]  
https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_items/1
[14]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3608032

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at