SA-CONTRIB-2026-223: Critical severity drupal/black_hole vulnerability
Published Oct 21, 2026
·Updated
The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles, either through menu administration or through content menu settings where permitted.
Credit
Drew Webber (mcdruid)(the Drupal Security Team)
Affected Software
1 affected componentFixes available
drupal/black_hole<8.x-1.26, <2.0.1
8.x-1.262.0.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/black_holeto a version that resolves this vulnerability.Fixed in 8.x-1.26Fixed in 2.0.1
Event History
Oct 21, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software