Description
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim’s browser.
Recommendation
Update the bootstrap-select package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.13.6
- Patched version(s): 1.13.6
References
- GHSA-7c82-mp33-r854
- snyk.io
- issues.jtl-software.de
- CVE-2019-20921
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- seajs Cross-site Scripting vulnerability - CVE-2024-51091
- XSS vulnerability that affects bootstrap - CVE-2018-20676
- Server-Side Template Injection in formio - CVE-2020-28246
- Path traversal in webpack-dev-middleware - CVE-2024-29180
- Tags:
- npm
- bootstrap-select
Anything's wrong? Let us know Last updated on November 25, 2024