The vulnerability stems from Bootstrap's carousel component handling of anchor elements with data-slide/data-slide-to attributes. When data-target is missing, the code falls back to using the href attribute without proper sanitization. The Carousel.prototype.handle and associated click handlers are responsible for processing these navigation events. These functions fail to properly validate() that the href value contains only a valid carousel selector, allowing execution of arbitrary JavaScript through javascript: URIs. The HeroDevs reproduction demonstrates this occurs in the carousel event handling logic, and the CWE-79 classification confirms this is an input sanitization failure in web page generation.