CVE-2026-114526 Drupal CVE debrief

Who should care

Defenders responsible for Drupal websites using the Black Hole theme should assess exposure and prioritize verification and updates. Defenders should review menu link titles for potential malicious activity and monitor for suspicious activity on Drupal websites using the Black Hole theme. Defenders should also verify and update to version 1.26.0 or later, or 2.0.1 or later.

Why it matters

The Black Hole theme for Drupal does not sufficiently sanitize menu link titles, potentially allowing attackers to inject malicious code. Defenders responsible for Drupal websites using the Black Hole theme should assess exposure and prioritize verification and updates.

• Defenders must verify and update the Black Hole theme to version 1.26.0 or later, or 2.0.1 or later
• Defenders should review menu link titles for potential malicious activity
• Defenders must monitor for suspicious activity on Drupal websites using the Black Hole theme

Technical summary

The Black Hole theme for Drupal does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability requires an attacker to be able to create or modify menu link titles through menu administration or content menu settings. The affected versions are versions prior to 1.26.0 or 2.0.0 to 2.0.0. This issue is mitigated by the requirement that the attacker must be able to create or modify menu link titles. Defenders should prioritize verifying and updating the Black Hole theme to version 1.26.0 or later, or 2.0.1 or later.

Defensive priority

Defenders should prioritize verifying and updating the Black Hole theme to version 1.26.0 or later, or 2.0.1 or later, and review menu link titles for potential malicious activity.

Recommended defensive actions

• Verify and update the Black Hole theme to version 1.26.0 or later, or 2.0.1 or later
• Review menu link titles for potential malicious activity
• Monitor for suspicious activity on Drupal websites using the Black Hole theme
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is mitigated by the requirement that the attacker must be able to create or modify menu link titles. The affected versions are versions prior to 1.26.0 or 2.0.0 to 2.0.0. Defenders should verify and update to version 1.26.0 or later, or 2.0.1 or later. The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.