In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Summary

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Timeline

1. Feb 20, 2019, 4:00 PM UTCCVE published
2. Aug 4, 2024, 9:17 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• bootstrapRubyGems

  fixed in 4.3.1

• bootstrap-sassRubyGems

  From 3.0.0 · fixed in 3.4.1

• Bootstrap.LessNuGet

  From 3.0.0 · fixed in 3.4.1

• bootstrapNuGet

  From 4.0.0 · fixed in 4.3.1

• bootstrapNuGet

  From 3.0.0 · fixed in 3.4.1

• bootstrap.sassNuGet

  fixed in 4.3.1

• bootstrapnpm

  From 4.0.0 · fixed in 4.3.1

• bootstrapnpm

  From 3.0.0 · fixed in 3.4.1

• bootstrap-sassnpm

  From 3.0.0 · fixed in 3.4.1

• twitter-bootstrap-railsRubyGems

  fixed in 5.3.0

• org.webjars:bootstrapMaven

  From 3.0.0 · fixed in 3.4.1

• org.webjars:bootstrapMaven

  From 4.0.0 · fixed in 4.3.1

• twbs/bootstrapPackagist

  From 3.0.0 · fixed in 3.4.1

• twbs/bootstrapPackagist

  From 4.0.0 · fixed in 4.3.1

References 28