Project: 
Bootstrap
Project machine name: 
bootstrap
Date: 
2026-October-21
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-site scripting
Affected versions: 
<3.45.0
CVE IDs: 
CVE-2026-114538
Description: 

Provides the Bootstrap front-end framework as a Drupal theme.

Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability.

This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on admin/appearance/settings/bootstrap or admin/appearance/settings/my_bootstrap_subtheme.

Solution: 

Install the latest version:

The 5.0.x branch of Bootstrap is not affected.

Reported By: 
Fixed By: 
Coordinated By: