Vulnerability DRUPAL-CONTRIB-2026-236
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 hours ago
October 21, 2026 at 05:48 PM UTC
No summary available
<3.45.0
<3.45.0
Details
Provides the Bootstrap front-end framework as a Drupal theme.
Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability.
This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
2 hours ago
October 21, 2026 at 05:48 PM UTC
Last Modified
1 hour ago
October 21, 2026 at 06:15 PM UTC