SA-CONTRIB-2026-236: Critical severity drupal/bootstrap vulnerability
Published Oct 21, 2026
·Updated
Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability. This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/mybootstrapsubtheme.
Credit
Ra Mänd (ram4nd)(the Drupal Security Team), provisional member(the Drupal Security Team)
Affected Software
1 affected componentFixes available
drupal/bootstrap<8.x-3.45
8.x-3.45
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/bootstrapto a version that resolves this vulnerability.Fixed in 8.x-3.45 - Configuration
Disable the optional tooltip and popover features on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.
Bootstrap Drupal theme tooltips and popovers = disabled
Event History
Oct 21, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software