CVE-2026-15084 Overview
CVE-2026-15084 is a stored Cross-Site Scripting (XSS) vulnerability in the Drupal UI Patterns module, specifically the Single Directory Components (SDC) integration in Drupal UI. The flaw affects UI Patterns (SDC in Drupal UI) versions 2.0.0 through 2.0.17. Authenticated users with content-editing privileges can inject persistent JavaScript that executes in the browsers of other users viewing affected pages. The issue is tracked under CWE-79 and stems from improper neutralization of user-supplied input during web page generation.
Critical Impact
An authenticated attacker with low privileges can inject persistent scripts that execute in victim browsers, enabling session theft, defacement, or forced actions across the Drupal site boundary.
Affected Products
- Drupal UI Patterns (SDC in Drupal UI) 2.0.0
- Drupal UI Patterns (SDC in Drupal UI) versions 2.0.1 through 2.0.16
- Drupal UI Patterns (SDC in Drupal UI) 2.0.17
Discovery Timeline
- 2026-07-10 - CVE-2026-15084 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-15084
Vulnerability Analysis
The vulnerability resides in how the UI Patterns module renders component properties supplied through the Drupal UI. UI Patterns integrates Single Directory Components (SDC), a Drupal core mechanism for bundling templates with their metadata. When component slot or prop values contain user-controlled input, the module fails to apply consistent output escaping before writing them into the generated markup.
An attacker with permission to configure or embed patterns can store an HTML or JavaScript payload in a component field. That payload is later rendered verbatim to any user who loads a page referencing the component. Because execution occurs in the site's origin, the attack crosses the trust boundary between the attacker's session and the victim's session, changing the scope of impact.
Exploitation requires an authenticated account with pattern-editing rights and user interaction from a victim who views the affected content.
Root Cause
The root cause is missing or incomplete output neutralization in the render pipeline for SDC props exposed through the UI Patterns configuration surface. Input intended for structured data or plain text is emitted into HTML contexts without the Twig |escape filter or Drupal Xss::filter() equivalent being consistently applied.
Attack Vector
The attack vector is network-based through the Drupal web interface. An authenticated user submits a component prop, slot, or configuration value containing a script payload, for example an onerror handler in an image tag or an inline event handler on an allowed HTML element. When another user, including administrators, visits a page that renders the component, the browser parses and executes the payload in the site origin.
Refer to the Drupal Security Advisory SA-CONTRIB-2026-075 for technical details on the affected code paths.
Detection Methods for CVE-2026-15084
Indicators of Compromise
- Unexpected <script> tags, on*= event handlers, or javascript: URIs stored in UI Patterns component configuration or content entities referencing SDC components.
- Outbound HTTP requests from authenticated browser sessions to attacker-controlled domains shortly after loading pages that render UI Patterns components.
- New or modified pattern configurations from user accounts that do not normally administer components.
Detection Strategies
- Audit the Drupal database for stored component values containing HTML control characters and JavaScript keywords in fields associated with ui_patterns and SDC props.
- Review web server access logs for POST requests to pattern configuration endpoints followed by GET requests that return payloads containing script content.
- Correlate Content Security Policy (CSP) violation reports with pages that embed UI Patterns components.
Monitoring Recommendations
- Enable and centrally collect Drupal watchdog logs, focusing on entity updates by users with pattern-editing permissions.
- Monitor administrative session activity for anomalous form submissions or privilege changes originating from browsers that loaded UI Patterns content.
- Alert on modifications to user roles and permissions that occur within short intervals after content editors save component data.
How to Mitigate CVE-2026-15084
Immediate Actions Required
- Upgrade the UI Patterns (SDC in Drupal UI) module to a version later than 2.0.17 as published in the vendor advisory.
- Review the list of users with permission to create or edit UI Patterns components and revoke access that is not required.
- Audit existing component configurations for injected script content and remove any suspicious entries before applying the update.
Patch Information
Drupal has published a fixed release referenced in the Drupal Security Advisory SA-CONTRIB-2026-075. Administrators should apply the updated module version through Composer or the Drupal update process and clear the render cache after deployment.
Workarounds
- Restrict the administer ui patterns and equivalent SDC configuration permissions to trusted roles only until the patch is applied.
- Deploy a strict Content Security Policy that blocks inline scripts and untrusted script sources to limit the impact of stored payloads.
- Place the Drupal site behind a web application firewall with rules that inspect POST payloads to pattern configuration endpoints for script markup.
# Update UI Patterns module using Composer
composer update 'drupal/ui_patterns' --with-dependencies
drush updatedb
drush cache:rebuild
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
