CVE-2026-81160: Drupal Slick Package Cross Site Scripting Vulnerability
Summary
CVE-2026-81160: Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Affects drupal/slick versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Slick module for Drupal is a powerful tool that allows users to create responsive carousels and sliders. It includes a sub-module called Slick UI, which enables the addition of custom option sets for carousel buttons. This flexibility, while beneficial for developers, can also introduce security risks if user input is not properly validated.
Vulnerability Detail
The vulnerability stems from insufficient validation of user input in the Slick UI sub-module. This oversight allows attackers to inject malicious HTML or JavaScript code, leading to a Cross Site Scripting (XSS) vulnerability. If exploited, this could allow an attacker to execute arbitrary scripts in the context of a user's session, potentially compromising sensitive data or performing actions on behalf of the user.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user input before it is processed by the Slick UI module. This can be done by implementing a custom validation function that strips out any HTML tags or JavaScript code from user inputs.
Conclusion
The CVE-2026-81160 vulnerability in the Drupal Slick module highlights the importance of input validation in web applications. By updating to the latest version and implementing proper sanitization practices, developers can protect their applications from potential XSS attacks.
See every vulnerability recorded for drupal/slick →
FAQ
The vulnerability allows for Cross Site Scripting (XSS) attacks, which can compromise user sessions and lead to unauthorized actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Run the command 'composer require drupal/slick:^2.1.0' in your terminal to update to the patched version.
XSS stands for Cross Site Scripting, a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Yes, implementing proper input validation and sanitization can help prevent XSS attacks. Always ensure user inputs are cleaned before processing.
