View online: https://www.drupal.org/sa-contrib-2026-075 Project: UI Patterns (SDC in Drupal UI) [1] Date: 2026-July-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <2.0.17 CVE IDs: CVE-2026-15084 Description:  This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC. The module doesn't sufficiently sanitize the markup passed to components under certain scenarios. This vulnerability is mitigated by the fact that an attacker must be able to create or update content rendered by UI Patterns. Solution:  Install the latest version: * If you use the UI Patterns module on version 2, upgrade to UI Patterns 2.0.17 [3] Reported By:  * Hervé Donner (herved) [4] Fixed By:  * Florent Torregrosa (grimreaper) [5] * Hervé Donner (herved) [6] * Mikael Meulle (just_like_good_vibes) [7] * Pierre Dureau (pdureau) [8] Coordinated By:  * Neil Drumm (drumm) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Dave Long (longwave) [12] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_items... [13] ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/ui_patterns [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ui_patterns/releases/2.0.17 [4] https://www.drupal.org/u/herved [5] https://www.drupal.org/u/grimreaper [6] https://www.drupal.org/u/herved [7] https://www.drupal.org/u/just_like_good_vibes [8] https://www.drupal.org/u/pdureau [9] https://www.drupal.org/u/drumm [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/longwave [13] https://git.drupalcode.org/security/185300-ui_patterns-security/-/work_items... [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....