GHSA-3wqf-4x89-9g79MediumCVSS 6.1

Bootstrap vulnerable to Cross-Site Scripting (XSS)

Published
May 13, 2022
Last Modified
August 5, 2024

🔗 CVE IDs covered (1)

CVE-2018-14040 →

📋 Description

In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.

🎯 Affected products12

  • npm/bootstrap:>= 4.0.0, < 4.1.2
  • rubygems/bootstrap:>= 4.0.0, < 4.1.2
  • npm/bootstrap:>= 2.3.0, < 3.4.0
  • rubygems/bootstrap:>= 2.3.0, < 3.4.0
  • maven/org.webjars:bootstrap:>= 4.0.0, < 4.1.2
  • maven/org.webjars:bootstrap:>= 2.3.0, < 3.4.0
  • nuget/bootstrap:>= 2.3.0, < 3.4.0
  • nuget/bootstrap:>= 4.0.0, < 4.1.2
  • nuget/bootstrap.sass:>= 4.0.0, < 4.1.2
  • rubygems/bootstrap-sass:>= 2.3.0, < 3.4.0
  • composer/twbs/bootstrap:>= 2.3.0, < 3.4.0
  • composer/twbs/bootstrap:>= 4.0.0, < 4.1.2

🔗 References (29)