The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation… (CVE-2026-114526)

The Black Hole theme for Drupal allows configurable layouts and supports Font Awesome icons in navigation menus. It fails to sufficiently sanitize menu link titles before inserting them into HTML class attributes, which could lead to security issues if an attacker can create or modify these titles. Exploitation requires the attacker to have permissions to modify menu link titles via menu administration or content menu settings. The vulnerability affects versions prior to 1.26.0 and versions from 2.0.0 up to but not including 2.0.1. A patch is available to fix this issue.

An attacker with the ability to create or modify menu link titles could exploit this vulnerability to inject malicious content into HTML class attributes, potentially leading to cross-site scripting or other client-side attacks. However, the requirement for specific permissions to modify menu link titles limits the scope of exploitation.

A patch is available for this vulnerability. Users should update to version 1.26.0 or later, or to version 2.0.1 or later. Restrict permissions to create or modify menu link titles to trusted users only to reduce risk until patching is applied.