SA-CONTRIB-2026-191: Critical severity drupal/diba_carousel vulnerability
The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms. This vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the "Allow HTML description" option.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/diba_carouselto a version that resolves this vulnerability.Fixed in 3.1.0Fixed in 3.0.2 - Configuration
Disable the "Allow HTML description" option to prevent slide descriptions from being rendered using the raw stored field value.
Diba Carousel Slider Allow HTML description = disabled
Event History
Frequently Asked Questions
Which deployments are affected?
Affected sites use the Diba Carousel Slider, select a formatted text field as the carousel description source, and enable the "Allow HTML description" option.
What can be done if patching is not immediately possible?
Disable the "Allow HTML description" option. This removes the configuration condition under which the raw stored description value is rendered.
How can administrators identify affected carousel configurations?
Review Diba Carousel Slider configurations for carousels with "Allow HTML description" enabled, then verify whether their description source is a formatted text field.