Project:
Project machine name:
swiper_formatterDate:
2026-October-21
Vulnerability:
Cross-site scripting
Affected versions:
<2.1.2 || >=3.0.1 <3.1.0
CVE IDs:
CVE-2026-114531
Description:
The module provides integration with third party JS library SwiperJs.
User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker would need a role with permission to edit the caption.
Solution:
Install the latest version:
- If you use the Swiper formatter module 3.x, upgrade to Swiper formatter 3.1.0
- If you use the Swiper formatter module 2.x, upgrade to Swiper formatter 2.1.2
Reported By:
- Drew Webber (mcdruid) of the Drupal Security Team
- Julian Pustkuchen (anybody)
- Joshua Sedler (grevil)
Fixed By:
- Drupal Lady (bbu23)
- Joshua Sedler (grevil)
- Drew Webber (mcdruid) of the Drupal Security Team
- nk_
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
