<div class="carousel-container">
  <div id="myCarousel" class="carousel slide">
    <div class="carousel-inner">
      <div class="item active">
        <img   
          src="https://placeholder.pics/svg/500x200/DEDEDE/555555/Slide%201"
          alt="First slide"
          data-holder-rendered="true"
        />
      </div>
      <div class="item">
        <img
          src="https://placeholder.pics/svg/500x200/1A12FF/DCE9FF/Slide%202"
          alt="Second slide"
          data-holder-rendered="true"
        />
      </div>
    </div>
  </div>
  <a
    href="javascript:alert('XSS href')"
    class="left"
    role="button"
    data-slide="prev"
  >
    Previous (XSS)
  </a>
  <a
    data-target="#myCarousel"
    class="right"
    role="button"
    data-slide="next"
  >
    Next (normal)
  </a>
</div>
body {
  padding: 1rem;
}

.carousel-container {
  width: 400px;
}

.right {
  float: right;
}

External CSS

  1. https://cdn.jsdelivr.net/npm/bootstrap@3.4.1/dist/css/bootstrap.min.css

External JavaScript

  1. https://cdn.staticfile.net/jquery/2.1.1/jquery.min.js
  2. https://cdn.jsdelivr.net/npm/bootstrap@3.4.1/dist/js/bootstrap.min.js