Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Description

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

Recommendation

No fix is available yet. Followings are affected versions:

• = 3.4.1

References

• GHSA-q58r-hwc8-rm9j
• www.herodevs.com
• lists.debian.org
• CVE-2025-1647
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - CVE-2024-6485
• Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers - CVE-2025-31137
• Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
• Bootstrap vulnerable to Cross-Site Scripting (XSS) - CVE-2018-14040

Tags:

npm

bootstrap