CVE-2026-15084: Drupal UI Patterns Module Insufficient Markup Sanitization Vulnerability
Summary
CVE-2026-15084: This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC. Affects drupal/ui_patterns versions >= 2.0.0, < 2.0.17. Fixed in 2.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal UI Patterns module allows developers to utilize Single Directory Components for site building tasks such as views, field formatters, blocks, and layouts. This module enhances the Developer Experience (DX) by streamlining the use of UI Patterns, making it easier to manage and implement design components within Drupal sites.
Vulnerability Detail
The vulnerability arises from the module's failure to adequately sanitize the markup passed to components in certain scenarios. This oversight can lead to potential security risks, as it may allow attackers to inject malicious content into the rendered output. The vulnerability is particularly concerning because it requires an attacker to have the ability to create or update content that is rendered by UI Patterns, which could lead to cross-site scripting (XSS) attacks or other forms of content manipulation.
How To Fix
Minimum fixed version
2.0.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict user permissions to prevent unauthorized users from creating or updating content that is rendered by UI Patterns. This will help mitigate the risk until the module is updated.
Conclusion
The CVE-2026-15084 vulnerability in the Drupal UI Patterns module highlights the importance of proper markup sanitization to prevent potential security threats. By updating to the latest version of the module and implementing user permission restrictions, you can safeguard your application against this vulnerability.
See every vulnerability recorded for drupal/ui_patterns →
FAQ
The vulnerability is related to insufficient sanitization of markup, which can lead to security risks such as XSS attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, restrict user permissions to limit access to content creation and updates that utilize UI Patterns.
Yes, updating to version 2.0.17 or later of the UI Patterns module will fix the vulnerability.
You can reach out to Hervé Donner, who reported the vulnerability, through their Drupal profile at https://www.drupal.org/u/herved.
