Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Description

Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

Recommendation

No fix is available yet. Followings are affected versions:

• = 3.4.1

References

• GHSA-q58r-hwc8-rm9j
• www.herodevs.com
• lists.debian.org
• CVE-2025-1647
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] (GHSA-963h-3v39-3pqf) - CVE-2025-27793
• Bootstrap Vulnerable to Cross-Site Scripting (GHSA-9v3m-8fp8-mj99) - CVE-2019-8331
• Bootstrap vulnerable to Cross-Site Scripting (XSS) - CVE-2018-14040
• Materialize-css vulnerable to Cross-site Scripting in tooltip component - CVE-2019-11002

Tags:

npm

bootstrap