Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Description

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

Recommendation

No fix is available yet. Followings are affected versions:

• = 3.4.1

References

• GHSA-q58r-hwc8-rm9j
• www.herodevs.com
• lists.debian.org
• CVE-2025-1647
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745
• svelte vulnerable to Cross-site Scripting - CVE-2025-15265
• `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
• Trix vulnerable to Cross-site Scripting on copy & paste - CVE-2025-46812

Tags:

npm

bootstrap