Executive brief
Diba Carousel Slider is a Drupal module that adds customizable carousel blocks to websites. When the "Allow HTML description" option is enabled, the module renders slide descriptions without sanitizing user input, allowing attackers to inject malicious scripts that execute in visitors' browsers. Sites using formatted text fields for carousel descriptions with this option enabled are vulnerable to account takeover and session hijacking.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the carousel description rendering logic. When "Allow HTML description" is enabled, the module bypasses Drupal's text format filtering and output sanitization, rendering raw stored field values instead of the filtered output. An attacker with permission to create or edit carousel slides can inject arbitrary HTML and JavaScript into descriptions, which executes in the browsers of all site visitors.
Affected products
- Diba Carousel Slider before 3.0.2
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: version 3.0.2 and 3.1.0 released