GitHub Advisoryadvisory · npm

GHSA-9r7h-6639-v5mw Cross-Site Scripting in bootstrap-select

HIGH Published 2020-09-03 Modified 2021-10-04 Official page ↗
Ecosystem
npm
Packages
bootstrap-select
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm bootstrap-select: < 1.13.6 → fixed in 1.13.6

Description

Versions of `bootstrap-select` prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS). The package does not escape `title` values on `` tags. This may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 1.13.6 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References