Vulnerability advisory

GHSA-4p24-vmcr-4gqj

Bootstrap Cross-site Scripting vulnerability

Published Jan 17, 2019Updated Sep 10, 2026OSV record ↗

Also known as CVE-2016-10735

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

bootstrap npm

All bootstrap advisories →

Affected	Fixed in
`2.0.4` to before 3.4.0	`3.4.0`Advisories →
`4.0.0-beta` to before 4.0.0-beta.2	`4.0.0-beta.2`Advisories →

org.webjars:bootstrap Maven

All org.webjars:bootstrap advisories →

Affected	Fixed in
`2.0.4` to before 3.4.0	`3.4.0`Advisories →
Also listed as affected (31) `2.1.1` `2.2.1` `2.2.2` `2.2.2-1` `2.3.0` `2.3.1` `2.3.1-1` `2.3.2` `3.0.0` `3.0.0-rc.2` `3.0.0-rc1` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.1.1-1` `3.1.1-2` `3.2.0` `3.2.0-1` `3.2.0-2` `3.3.0` `3.3.1` `3.3.2` `3.3.2-1` `3.3.2-2` `3.3.4` `3.3.5` `3.3.6` `3.3.7` `3.3.7-1`
`4.0.0-beta` to before 4.0.0-beta.2	`4.0.0-beta.2`Advisories →
Also listed as affected (2) `4.0.0-beta` `4.0.0-beta-1`

bootstrap RubyGems

All bootstrap advisories →

Affected	Fixed in
All versions before 4.0.0-beta.2	`4.0.0-beta.2`Advisories →

twbs/bootstrap Packagist

All twbs/bootstrap advisories →

Affected	Fixed in
`2.0.4` to before 3.4.0	`3.4.0`Advisories →
Also listed as affected (20) `v2.2.2` `v2.3.0` `v2.3.1` `v2.3.2` `v3.0.0` `v3.0.0-rc.2` `v3.0.0-rc1` `v3.0.1` `v3.0.2` `v3.0.3` `v3.1.0` `v3.1.1` `v3.2.0` `v3.3.0` `v3.3.1` `v3.3.2` `v3.3.4` `v3.3.5` `v3.3.6` `v3.3.7`
`4.0.0-beta` to before 4.0.0-beta.2	`4.0.0-beta.2`Advisories →
Also listed as affected (1) `v4.0.0-beta`

bootstrap NuGet

All bootstrap advisories →

Affected	Fixed in
`2.0.4` to before 3.4.0	`3.4.0`Advisories →
Also listed as affected (18) `2.3.1` `2.3.2` `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.2.0` `3.3.0` `3.3.1` `3.3.2` `3.3.4` `3.3.5` `3.3.6` `3.3.6-jQuery3` `3.3.6.1` `3.3.7`
`4.0.0-beta` to before 4.0.0-beta.2	`4.0.0-beta.2`Advisories →
Also listed as affected (1) `4.0.0-beta`

bootstrap-sass npm

All bootstrap-sass advisories →

Affected	Fixed in
`2.0.4` to before 3.4.0	`3.4.0`Advisories →

bootstrap-sass RubyGems

All bootstrap-sass advisories →

Affected Fixed in

2.0.4 to before 3.4.0 3.4.0Advisories →

Also listed as affected (42)

bootstrap.sass NuGet

All bootstrap.sass advisories →

Affected	Fixed in
`4.0.0-beta` to before 4.0.0-beta.2	`4.0.0-beta.2`Advisories →
Also listed as affected (1) `4.0.0-beta`

Description

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.

GHSA-4p24-vmcr-4gqj

Affected versions

bootstrap npm

org.webjars:bootstrap Maven

bootstrap RubyGems

twbs/bootstrap Packagist

bootstrap NuGet

bootstrap-sass npm

bootstrap-sass RubyGems

bootstrap.sass NuGet

Description

References