Vulnerability advisory

GHSA-3mgp-fx93-9xv5

XSS vulnerability that affects bootstrap

Published Jan 17, 2019Updated Sep 10, 2026OSV record ↗

Severity

Affected versions

Affected	Fixed in
All versions before 3.4.0	`3.4.0`Advisories →

Affected	Fixed in
All versions before 3.4.0	`3.4.0`Advisories →

Affected	Fixed in
All versions before 3.4.0	`3.4.0`Advisories →
Also listed as affected (20) `v2.2.2` `v2.3.0` `v2.3.1` `v2.3.2` `v3.0.0` `v3.0.0-rc.2` `v3.0.0-rc1` `v3.0.1` `v3.0.2` `v3.0.3` `v3.1.0` `v3.1.1` `v3.2.0` `v3.3.0` `v3.3.1` `v3.3.2` `v3.3.4` `v3.3.5` `v3.3.6` `v3.3.7`

Affected	Fixed in
All versions before 3.4.0	`3.4.0`Advisories →
Also listed as affected (33) `1.3.0` `2.0.2` `2.1.1` `2.2.1` `2.2.2` `2.2.2-1` `2.3.0` `2.3.1` `2.3.1-1` `2.3.2` `3.0.0` `3.0.0-rc.2` `3.0.0-rc1` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.1.1-1` `3.1.1-2` `3.2.0` `3.2.0-1` `3.2.0-2` `3.3.0` `3.3.1` `3.3.2` `3.3.2-1` `3.3.2-2` `3.3.4` `3.3.5` `3.3.6` `3.3.7` `3.3.7-1`

Affected	Fixed in
All versions before 3.4.0	`3.4.0`Advisories →

Affected Fixed in

All versions before 3.4.0 3.4.0Advisories →

Also listed as affected (57)

Affected	Fixed in
All versions before 3.4.0	`3.4.0`Advisories →
Also listed as affected (19) `1.0.0` `2.3.1` `2.3.2` `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.2.0` `3.3.0` `3.3.1` `3.3.2` `3.3.4` `3.3.5` `3.3.6` `3.3.6-jQuery3` `3.3.6.1` `3.3.7`

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.