GHSA-3wqf-4x89-9g79
GitHub Security Advisory
Bootstrap vulnerable to Cross-Site Scripting (XSS)
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
Affected Packages
npm
bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
RubyGems
bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
npm
bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
RubyGems
bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
Maven
org.webjars:bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
Maven
org.webjars:bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
NuGet
bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
NuGet
bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
NuGet
bootstrap.sass
Affected versions:
4.0.0
(fixed in 4.1.2)
RubyGems
bootstrap-sass
Affected versions:
2.3.0
(fixed in 3.4.0)
Packagist
twbs/bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
Packagist
twbs/bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: October 1, 2025 6:29 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.