Vulnerability advisory

GHSA-7mvr-5x2g-wfc8

Bootstrap Cross-site Scripting vulnerability

Published Sep 13, 2018Updated Sep 10, 2026OSV record ↗

Also known as CVE-2018-14042

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

bootstrap RubyGems

All bootstrap advisories →

Affected	Fixed in
`4.0.0` to before 4.1.2	`4.1.2`Advisories →
Also listed as affected (3) `4.0.0` `4.1.0` `4.1.1`
`2.3.0` to before 3.4.0	`3.4.0`Advisories →

bootstrap npm

All bootstrap advisories →

Affected	Fixed in
`4.0.0` to before 4.1.2	`4.1.2`Advisories →
`2.3.0` to before 3.4.0	`3.4.0`Advisories →

org.webjars:bootstrap Maven

All org.webjars:bootstrap advisories →

Affected	Fixed in
`4.0.0` to before 4.1.2	`4.1.2`Advisories →
Also listed as affected (5) `4.0.0` `4.0.0-1` `4.0.0-2` `4.1.0` `4.1.1`
`2.3.0` to before 3.4.0	`3.4.0`Advisories →
Also listed as affected (27) `2.3.0` `2.3.1` `2.3.1-1` `2.3.2` `3.0.0` `3.0.0-rc.2` `3.0.0-rc1` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.1.1-1` `3.1.1-2` `3.2.0` `3.2.0-1` `3.2.0-2` `3.3.0` `3.3.1` `3.3.2` `3.3.2-1` `3.3.2-2` `3.3.4` `3.3.5` `3.3.6` `3.3.7` `3.3.7-1`

twbs/bootstrap Packagist

All twbs/bootstrap advisories →

Affected	Fixed in
`4.0.0` to before 4.1.2	`4.1.2`Advisories →
Also listed as affected (3) `v4.0.0` `v4.1.0` `v4.1.1`
`2.3.0` to before 3.4.0	`3.4.0`Advisories →
Also listed as affected (19) `v2.3.0` `v2.3.1` `v2.3.2` `v3.0.0` `v3.0.0-rc.2` `v3.0.0-rc1` `v3.0.1` `v3.0.2` `v3.0.3` `v3.1.0` `v3.1.1` `v3.2.0` `v3.3.0` `v3.3.1` `v3.3.2` `v3.3.4` `v3.3.5` `v3.3.6` `v3.3.7`

bootstrap NuGet

All bootstrap advisories →

Affected	Fixed in
`4.0.0` to before 4.1.2	`4.1.2`Advisories →
Also listed as affected (4) `4.0.0` `4.1.0` `4.1.1` `4.1.1-contentFiles`
`2.3.0` to before 3.4.0	`3.4.0`Advisories →
Also listed as affected (18) `2.3.1` `2.3.2` `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.2.0` `3.3.0` `3.3.1` `3.3.2` `3.3.4` `3.3.5` `3.3.6` `3.3.6-jQuery3` `3.3.6.1` `3.3.7`

bootstrap-sass RubyGems

All bootstrap-sass advisories →

Affected	Fixed in
`2.3.0` to before 3.4.0	`3.4.0`Advisories →
Also listed as affected (33) `2.3.0.0` `2.3.0.1` `2.3.1.0` `2.3.1.2` `2.3.1.3` `2.3.2.0` `2.3.2.1` `2.3.2.2` `3.0.0.0` `3.0.0.0.rc` `3.0.0.0.rc2` `3.0.1.0` `3.0.1.0.rc` `3.0.2.0` `3.0.2.1` `3.0.3.0` `3.1.0.0` `3.1.0.1` `3.1.0.2` `3.1.1.0` `3.1.1.1` `3.2.0.4` `3.3.0.0` `3.3.0.1` `3.3.1.0` `3.3.2.0` `3.3.2.1` `3.3.3` `3.3.4.1` `3.3.5` `3.3.5.1` `3.3.6` `3.3.7`

bootstrap-sass npm

All bootstrap-sass advisories →

Affected	Fixed in
`2.0.4` to before 3.4.0	`3.4.0`Advisories →

bootstrap.sass NuGet

All bootstrap.sass advisories →

Affected	Fixed in
`4.0.0` to before 4.1.2	`4.1.2`Advisories →
Also listed as affected (4) `4.0.0` `4.1.0` `4.1.1` `4.1.1-contentFiles`

Description

In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041.

GHSA-7mvr-5x2g-wfc8

Affected versions

bootstrap RubyGems

bootstrap npm

org.webjars:bootstrap Maven

twbs/bootstrap Packagist

bootstrap NuGet

bootstrap-sass RubyGems

bootstrap-sass npm

bootstrap.sass NuGet

Description

References