UI Patterns XSS Fix Changes How Component Markup Is Handled

A Drupal Security Team advisory issued on 8 July 2026 disclosed a moderately critical cross-site scripting vulnerability in UI Patterns 2.x. The vulnerability, tracked as CVE-2026-15084, affected versions from 2.0.0 up to but not including 2.0.17. Drupal.org says the module did not sufficiently sanitise markup passed to components under certain scenarios.

The advisory assigns the issue a security risk score of 14 out of 25 and describes exploitation as theoretical. An attacker would need permission to create or update content that is subsequently rendered through UI Patterns, limiting the circumstances in which the vulnerability can be exploited. The Drupal Security Team recommends updating affected UI Patterns 2.x installations to a fixed release.

UI Patterns 2.0.17, released on the same day as the advisory, contains the security fix alongside string-normalisation changes, test-performance improvements, and other maintenance work. The advisory identifies 2.0.17 as the fixed version for sites using the 2.x branch.

The rendering changes continued after the security release. Version 2.0.18, released on 17 July, includes a follow-up change described as “Escape at render, not in sources,” relying on Twig auto-escaping. During UI Suite Monthly #37, maintainers described the security work as a broader change to how component data flows into rendering: strings carrying markup are no longer handled in the previous way, while escaping responsibility has been moved toward Twig.

The change is relevant beyond sites that use UI Patterns as a standalone component tool. UI Patterns exposes Single Directory Components through Drupal interfaces including blocks, layouts, field formatters, and Views, and the project page identifies it as the component layer powering Display Builder. Sites evaluating or updating Display Builder therefore also need to account for the UI Patterns version used in the surrounding component stack.

UI Patterns 2.0.19, released on 6 August 2026, is now the current tagged stable release in the 2.x branch and includes the earlier security correction. Its changes focus on synchronised translations and maintenance work rather than another security advisory. Administrators still running UI Patterns 2.0.0 through 2.0.16 should move to a fixed supported release rather than treating 2.0.17 as a historical release they need to install specifically.

The vulnerability was reported by Hervé Donner. Drupal.org credits Florent Torregrosa, Hervé Donner, Mikael Meulle, and Pierre Dureau with the fix, coordinated with members of the Drupal Security Team.