Provides the Bootstrap front-end framework as a Drupal theme. (CVE-2026-114538)

The Drupal Bootstrap theme, which integrates the Bootstrap front-end framework as a Drupal theme, has a vulnerability where insufficient filtering of certain attributes in the tooltip and popover features can lead to cross-site scripting (XSS). This vulnerability is limited in scope to these optional features. Administrators can mitigate the risk temporarily by disabling tooltips and popovers in the theme settings. A fix has been made available to resolve this issue.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected Drupal site via the tooltip and popover features, potentially leading to session hijacking or other XSS-related impacts. However, the vulnerability is limited to optional features, reducing the attack surface.

A patch is available to fix this vulnerability. In the short term, administrators should disable the tooltip and popover features on the affected Drupal Bootstrap theme settings pages (`admin/appearance/settings/bootstrap` or `admin/appearance/settings/my_bootstrap_subtheme`). Applying the official patch or updating to a fixed version is recommended for complete remediation.