Black Hole security updates, in plain English

Black Hole

177 sites report using it · on drupal.org · 1 security update explained here

This theme provides a dark design with customisation options for the layout and visual style of a website.

Below is every security update for Black Hole that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this theme and you are not sure which version, that is the first question to ask whoever looks after it.

Black Hole

Critical · Theme · 177 sites report using it · SA-CONTRIB-2026-223 · on drupal.org · Week of 21 October 2026

The theme fails to clean up the text used for menu link titles before adding them to the page code. Someone could use this flaw to view restricted information or alter parts of the website. They could not take full control of the website or read every piece of private data.

Who could do thisAnyone visiting the site. No login needed.
Does it apply to youThis applies if a person has the access right to create or edit menu link titles.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.

Tell your developerUpdate Black Hole to 2.0.1 or 8.x-1.26, whichever branch you are on.

For developers: what the fix changed

The diff does not appear to contain the fix for the XSS vulnerability, as the changes to the PHP and Twig files where menu link titles would be sanitised are missing.

The fix is not clearly separable from the other changes in this release, so treat the summary above as a pointer rather than a finding.

Also in this release The release updated theme configuration, bundled CSS files, and documentation, and added new layout and styling options.

2.0.0 to 2.0.1 2 commits, 125 files.

CHANGELOG.txt +20 −2
Readme.md +0 −0
_custom/README.txt +11 −14
_custom/example.custom-style.css +0 −0
_custom/optional-layouts.html +0 −65
black_hole.info.yml +1 −0
black_hole.libraries.yml +101 −139
config/install/black_hole.settings.yml +69 −5
config/schema/black_hole.schema.yml +33 −37
css/_cart.css +25 −10
css/_font-merriweather.css +11 −6
css/_font-montserrat.css +11 −6

Full diff, 2.0.0 to 2.0.1 · Full diff, 8.x-1.25 to 8.x-1.26

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK membership bodies, charities and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Black Hole

Black Hole

Send me your Drupal site's address.

Get in touch

Links

Reference