Live › vulnerability › CVE-2026-114538
The Drupal Bootstrap theme library has a cross-site scripting flaw in versions up to and including 3.45.0. An attacker can inject script into pages that the library renders, which runs in the browser of a visitor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Bootstrap theme or module at version 3.45.0 or earlier are in scope. The sources do not say which input paths are exploitable, so treat any site with that version as exposed until the vendor confirms otherwise.
No product ranges from the sources yet.
drush pm:list or the module's .info.yml file).3.45.0 in a Drupal site that uses the Bootstrap theme.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114538")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.