GHSA-7mvr-5x2g-wfc8
GitHub Security Advisory
Bootstrap Cross-site Scripting vulnerability
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041.
Affected Packages
RubyGems
bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
RubyGems
bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
npm
bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
npm
bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
Maven
org.webjars:bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
Maven
org.webjars:bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
Packagist
twbs/bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
Packagist
twbs/bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
NuGet
bootstrap
Affected versions:
4.0.0
(fixed in 4.1.2)
NuGet
bootstrap
Affected versions:
2.3.0
(fixed in 3.4.0)
RubyGems
bootstrap-sass
Affected versions:
2.3.0
(fixed in 3.4.0)
npm
bootstrap-sass
Affected versions:
2.0.4
(fixed in 3.4.0)
NuGet
bootstrap.sass
Affected versions:
4.0.0
(fixed in 4.1.2)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: October 1, 2025 6:29 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.