Cross-site Scripting in bootstrap-table

Description

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.

Recommendation

Update the bootstrap-table package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.20.2
• Patched version(s): 1.20.2

References

• GHSA-grw5-g9h2-wpg8
• huntr.dev
• CVE-2022-1726
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in bootstrap-table - bootstrap-table - CVE-2021-23472
• Cross-site scripting in react-bootstrap-table - CVE-2021-23398
• CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-markdown-gfm - CVE-2022-31175
• CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - CVE-2022-31175

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

bootstrap-table