CVE-2026-114538

ALTO 7.1CVE-2026-114538 · DRUPAL-CONTRIB-2026-236 · Published 30/10/2026 · updated 06/11/2026

En resumen

CVE-2026-114538 es una vulnerabilidad ALTO (CVSS 7.1) que afecta a drupal/bootstrap.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.18%, mayor que el 7.6% de las vulnerabilidades.
Solución: actualizar a 3.45.0 o posterior.

Package	Affected versions	Patched versions
drupal/bootstrap Packagist:https://packages.drupal.org/8	`< 3.45.0`	`3.45.0`

Description

Provides the Bootstrap front-end framework as a Drupal theme.

Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability.

This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.

NVD description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

References

drupal.org/sa-contrib-2026-236 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free