{"id":"CVE-2026-15084","aliases":["DRUPAL-CONTRIB-2026-075","EUVD-2026-43079","GHSA-rx7v-qfjw-hc2q"],"status":"published","title":"UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00231,"percentile":0.14041,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-07-08T17:17:41Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ui_patterns","fixed_in":["2.0.17"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ui_patterns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.17"}]}]}],"products":[{"vendor":"ademarco","product":"ui_patterns"},{"vendor":"drupal","product":"ui patterns (sdc in drupal ui)"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-075","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15084","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rx7v-qfjw-hc2q"},{"url":"https://git.drupalcode.org/project/ui_patterns","tags":["web"]},{"url":"https://www.drupal.org/project/ui_patterns","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15084.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15084","title":"UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.","status":"published","published":"2026-07-10T21:46:34.771Z","modified":"2026-07-13T18:14:56.574Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-43079","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.","status":"published","published":"2026-07-10T21:46:34Z","modified":"2026-07-13T18:14:56Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:01.134466Z"}],"ghsa":[{"id":"GHSA-rx7v-qfjw-hc2q","title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")...","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.","status":"published","published":"2026-07-11T00:31:48Z","modified":"2026-07-13T21:32:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:26.474991Z"}],"nvd":[{"id":"CVE-2026-15084","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.","status":"published","published":"2026-07-10T22:16:41.127Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:28.771746Z"}],"osv":[{"id":"CVE-2026-15084","title":"UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.","status":"published","published":"2026-07-10T21:46:34.771Z","modified":"2026-10-28T02:30:40.431440695Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DRUPAL-CONTRIB-2026-075","description":"This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC.\n\nThe module doesn't sufficiently sanitize the markup passed to components under certain scenarios.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to create or update content rendered by UI Patterns.","status":"published","published":"2026-07-08T17:17:41Z","modified":"2026-09-10T03:46:14.073957401Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}