SA-CONTRIB-2026-117: XSS
Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting (XSS) vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that was not marked as a security release at the time.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.x-2.1 - Configuration
Ensure Slick UI option sets used for carousel buttons do not include unvalidated user input/HTML to prevent XSS (module previously did not sufficiently validate user input).
Slick (Slick UI sub-module) Carousel button HTML input validation = disable/avoid allowing unvalidated HTML in Slick option sets for carousel buttons
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Drupal sites using the Slick UI sub-module are exposed if they use Slick option sets that can contain HTML for carousel buttons and are running a release without the input-validation fix.
What would an attacker need to exploit it?
An attacker would need a way to supply malicious HTML through Slick option-set input that is used for carousel buttons. The provided information does not identify the specific permissions or input path required.
Is there a known fixed release?
Yes. The issue was fixed in Slick version 8.x-2.1, although that release was not initially marked as a security release.