An improper neutralization of input during web page generation in Drupal Bootstrap allows attackers to inject malicious scripts into pages served to user browsers. The flaw lies in insufficient output encoding for user-supplied data, exposing sites to the classic cross‑site scripting attack model. When exploited, an attacker can execute arbitrary JavaScript in the victim’s context, enabling script‑based data theft, session hijacking, or defacement of the web page.

Drupal users employing the Bootstrap theme module are affected. The vulnerability spans all released versions from the initial 0.0.0 release up to and including 3.45.0. Sites that have not yet upgraded past 3.45.0 should assess whether the module is installed and in use.

The flaw can be triggered by submitting crafted input through a web form or URL that is rendered by the Bootstrap module. While no public exploit has been observed and the EPSS score is not available, the vulnerability is present in all exposed versions, giving attackers ample opportunity to craft attacks. The vulnerability is not listed in the CISA KEV catalog and no confirmed public exploits are documented.