CVE-2026-114538

HOCH 7.1CVE-2026-114538 · DRUPAL-CONTRIB-2026-236 · Published 30/10/2026 · updated 06/11/2026

Kurz gesagt

CVE-2026-114538 ist eine Schwachstelle (HOCH (CVSS 7.1)) in drupal/bootstrap.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.18%, höher als bei 7.6% aller Schwachstellen.
Abhilfe: auf 3.45.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
drupal/bootstrap Packagist:https://packages.drupal.org/8	`< 3.45.0`	`3.45.0`

Description

Provides the Bootstrap front-end framework as a Drupal theme.

Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability.

This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.

NVD description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

References

drupal.org/sa-contrib-2026-236 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free