SA-CONTRIB-2026-228: XSS
Published Oct 21, 2026
·Updated
The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to edit the caption.
Credit
Drew Webber (mcdruid)(the Drupal Security Team), Julian Pustkuchen (anybody), Joshua Sedler (grevil)
Affected Software
1 affected componentFixes available
drupal/swiper_formatter<3.1.0, <2.1.2
3.1.02.1.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/swiper_formatterto a version that resolves this vulnerability.Fixed in 3.1.0Fixed in 2.1.2
Event History
Oct 21, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software