- Package
- drupal/swiper_formatter
- Fixed in
- 2.1.2, 3.1.0
- Published
- Wed 21 Oct 2026, 18:42 Lisbon
In plain words
The Swiper Formatter module uses user-entered slide text without appropriate filtering, allowing cross-site scripting (XSS). An attacker needs a role with permission to edit the caption.
Am I affected?
Look for drupal/swiper_formatter and its installed version in composer.lock. The advisory lists 2.1.2 and 3.1.0 as fixed versions but gives no affected version range. Check which roles have permission to edit the caption, as an attacker needs that permission.
What to do
Check which version you have, then update to a fixed release for your branch (2.1.2, 3.1.0):
composer show drupal/swiper_formatter | grep versions
composer update drupal/swiper_formatterIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement that an attacker have a role with permission to edit the caption.
The advisory's description
The module provides integration with third party JS library SwiperJs.
User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker would need a role with permission to edit the caption.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-228
- The week's digest, with the other advisories from 19 Oct 2026
- All advisories for drupal/swiper_formatter