{"id":"CVE-2026-114538","kind":"vulnerability","aliases":["CVE-2026-114538"],"related":[],"title":"Drupal Bootstrap: cross-site scripting flaw lets pages run attacker script","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.","summary":"The Drupal Bootstrap theme library has a cross-site scripting flaw in versions up to and including 3.45.0. An attacker can inject script into pages that the library renders, which runs in the browser of a visitor.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-bootstrap","package","self-hosted"],"not_affected_if":["bootstrap-not-installed","not-drupal"],"how_to_check":"- Check the installed Bootstrap module version in the Drupal project (for example with `drush pm:list` or the module's `.info.yml` file).\n- Look for any version up to `3.45.0` in a Drupal site that uses the Bootstrap theme.","fix":null,"status":"open","published_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:57+00:00","updated_at":"2026-10-30T04:29:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal Bootstrap: cross-site scripting flaw lets pages run attacker script","impact":"medium","summary":"The Drupal Bootstrap theme library has a cross-site scripting flaw in versions up to and including 3.45.0. An attacker can inject script into pages that the library renders, which runs in the browser of a visitor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","drupal-bootstrap","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Confirm the fixed version and the vulnerable input path from the NVD entry or the Drupal security advisory.","how_to_check":"- Check the installed Bootstrap module version in the Drupal project (for example with `drush pm:list` or the module's `.info.yml` file).\n- Look for any version up to `3.45.0` in a Drupal site that uses the Bootstrap theme.","plain_action":"","needs_analyst":true,"not_affected_if":["not-drupal","bootstrap-not-installed"],"who_is_affected":"Sites running the Drupal Bootstrap theme or module at version 3.45.0 or earlier are in scope. The sources do not say which input paths are exploitable, so treat any site with that version as exposed until the vendor confirms otherwise.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4116,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114538':15A,18A '-2026':14A,17A '0.0.0':93C '3.45.0':45B,95C 'affect':89C 'allow':81C 'attack':11A,47B 'bootstrap':2A,22B,29B,80C,90C 'browser':61B 'cross':4A,35B,74C,83C 'cross-sit':3A,34B,73C,82C 'cve':13A,16A 'drupal':1A,19B,21B,28B,79C 'drupal-bootstrap':20B 'flaw':7A,38B 'generat':72C 'host':26B 'improp':65C 'includ':44B 'inject':49B 'input':68C 'issu':88C 'let':8A 'librari':31B,55B 'neutral':66C 'packag':23B 'page':9A,52B,71C 'render':56B 'run':10A,58B 'script':6A,12A,37B,50B,76C,85C 'self':25B 'self-host':24B 'site':5A,36B,75C,84C 'theme':30B 'version':40B,91C 'visitor':64B 'vulner':77C 'web':70C 'xss':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Bootstrap theme or module at version 3.45.0 or earlier are in scope. The sources do not say which input paths are exploitable, so treat any site with that version as exposed until the vendor confirms otherwise.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114538","severity":null,"published_at":"2026-10-30T04:18:12+00:00","modified_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}