GitHub Advisoryadvisory · npm

GHSA-vxmc-5x29-h64v Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes

MEDIUM Published 2024-07-11 Modified 2025-11-03 Official page ↗
Aliases
CVE-2024-6485
Ecosystem
npm
Packages
bootstrap
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-79
Reviewed
2024-11-18

Affected packages

• npm bootstrap: >= 1.4.0, <= 3.4.1 (no fix yet)

Description

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

Related

Alias · CVE (1)

  • CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References