Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Description

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

Recommendation

No fix is available yet. Followings are affected versions:

• = 3.4.1

References

• GHSA-q58r-hwc8-rm9j
• www.herodevs.com
• lists.debian.org
• CVE-2025-1647
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap vulnerable to Cross-Site Scripting (XSS) - CVE-2018-14040
• @tiptap/extension-link vulnerable to Cross-site Scripting (XSS) - CVE-2025-14284
• jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
• Nuxt DevTools vulnerable to cross-site scripting (XSS) - CVE-2025-52662

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

bootstrap