Project:
Date:
2026-July-08
Vulnerability:
Cross site scripting
Affected versions:
>=2.0.0 <2.0.17
CVE IDs:
CVE-2026-15084
Description:
This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC.
The module doesn't sufficiently sanitize the markup passed to components under certain scenarios.
This vulnerability is mitigated by the fact that an attacker must be able to create or update content rendered by UI Patterns.
Solution:
Install the latest version:
- If you use the UI Patterns module on version 2, upgrade to UI Patterns 2.0.17
Reported By:
Fixed By:
Coordinated By:
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
