DRUPAL-CONTRIB-2026-117

Import Source

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-117

Aliases

Published

2026-08-26T17:45:39Z

Modified

2026-08-26T22:30:05.143522091Z

Summary

[none]

Details

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons.

Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting (XSS) vulnerability.

Note: This vulnerability was fixed in 8.x-2.1 but that was not marked as a security release at the time.

References

Credits

Affected packages

Name: drupal/slick
Purl: pkg:composer/drupal/slick?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Type

ECOSYSTEM

Events

Introduced

Fixed

2.1.0

Database specific

Show details

{
    "constraint": "<2.1.0"
}

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/slick/DRUPAL-CONTRIB-2026-117.json"

affected_versions

"<2.1.0"