PatchClock

PHP security digest · 21 Oct 2026

Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site...

Unrated CVE-2026-114538

Package
drupal/bootstrap
Fixed in
3.45.0
Published
Wed 21 Oct 2026, 18:48 Lisbon

In plain words

The Bootstrap Drupal theme did not sufficiently filter certain attributes, which could allow an attacker to run JavaScript in a user's browser through cross-site scripting. The flaw only affects the optional tooltip and popover features.

Am I affected?

Look for drupal/bootstrap and its installed version in composer.lock. The advisory lists 3.45.0 as fixed but gives no affected version range. Check whether tooltips or popovers are enabled at admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.

What to do

Check which version you have, then update to a fixed release for your branch (3.45.0):

composer show drupal/bootstrap | grep versions
composer update drupal/bootstrap

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

As a short-term mitigation, disable tooltips and popovers at admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.

The advisory's description

Provides the Bootstrap front-end framework as a Drupal theme.

Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability.

This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.