Bootstrap Cross-site Scripting vulnerability (GHSA-4p24-vmcr-4gqj)

Description

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.

Recommendation

Update the bootstrap package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 2.0.4, < 3.4.0

  >= 4.0.0-beta, < 4.0.0-beta.2**

• Patched version(s): **3.4.0

  4.0.0-beta.2**

References

• GHSA-4p24-vmcr-4gqj
• access.redhat.com
• blog.getbootstrap.com
• CVE-2016-10735
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap Cross-site Scripting vulnerability (GHSA-pj7m-g53m-7638) - CVE-2018-14041
• Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
• @astrojs/node's trailing slash handling causes open redirect issue - CVE-2025-55207
• Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101

Tags:

npm

bootstrap