Vulnerability advisory

GHSA-9v3m-8fp8-mj99

Bootstrap Vulnerable to Cross-Site Scripting

Published Feb 22, 2019Updated Sep 10, 2026OSV record ↗

Also known as CVE-2019-8331

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

bootstrap RubyGems

All bootstrap advisories →

Affected	Fixed in
All versions before 4.3.1	`4.3.1`Advisories →
Also listed as affected (18) `4.0.0` `4.0.0.alpha1` `4.0.0.alpha2` `4.0.0.alpha3` `4.0.0.alpha3.1` `4.0.0.alpha4` `4.0.0.alpha5` `4.0.0.alpha6` `4.0.0.beta` `4.0.0.beta2` `4.0.0.beta2.1` `4.0.0.beta3` `4.1.0` `4.1.1` `4.1.2` `4.1.3` `4.2.1` `4.3.0`

bootstrap-sass RubyGems

All bootstrap-sass advisories →

Affected	Fixed in
`3.0.0` to before 3.4.1	`3.4.1`Advisories →
Also listed as affected (24) `3.0.0.0` `3.0.1.0` `3.0.1.0.rc` `3.0.2.0` `3.0.2.1` `3.0.3.0` `3.1.0.0` `3.1.0.1` `3.1.0.2` `3.1.1.0` `3.1.1.1` `3.2.0.4` `3.3.0.0` `3.3.0.1` `3.3.1.0` `3.3.2.0` `3.3.2.1` `3.3.3` `3.3.4.1` `3.3.5` `3.3.5.1` `3.3.6` `3.3.7` `3.4.0`

Bootstrap.Less NuGet

All Bootstrap.Less advisories →

Affected	Fixed in
`3.0.0` to before 3.4.1	`3.4.1`Advisories →
Also listed as affected (6) `3.3.5` `3.3.6` `3.3.6-jQuery3` `3.3.6.1` `3.3.7` `3.4.0`

bootstrap NuGet

All bootstrap advisories →

Affected	Fixed in
`4.0.0` to before 4.3.1	`4.3.1`Advisories →
Also listed as affected (7) `4.0.0` `4.1.0` `4.1.1` `4.1.1-contentFiles` `4.1.2` `4.1.3` `4.2.1`
`3.0.0` to before 3.4.1	`3.4.1`Advisories →
Also listed as affected (17) `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.2.0` `3.3.0` `3.3.1` `3.3.2` `3.3.4` `3.3.5` `3.3.6` `3.3.6-jQuery3` `3.3.6.1` `3.3.7` `3.4.0`

bootstrap.sass NuGet

All bootstrap.sass advisories →

Affected	Fixed in
All versions before 4.3.1	`4.3.1`Advisories →
Also listed as affected (17) `3.4.1` `4.0.0` `4.0.0-alpha` `4.0.0-alpha2` `4.0.0-alpha3` `4.0.0-alpha4` `4.0.0-alpha5` `4.0.0-alpha6` `4.0.0-beta` `4.0.0-beta2` `4.0.0-beta3` `4.1.0` `4.1.1` `4.1.1-contentFiles` `4.1.2` `4.1.3` `4.2.1`

bootstrap npm

All bootstrap advisories →

Affected	Fixed in
`4.0.0` to before 4.3.1	`4.3.1`Advisories →
`3.0.0` to before 3.4.1	`3.4.1`Advisories →

bootstrap-sass npm

All bootstrap-sass advisories →

Affected	Fixed in
`3.0.0` to before 3.4.1	`3.4.1`Advisories →

twitter-bootstrap-rails RubyGems

All twitter-bootstrap-rails advisories →

Affected Fixed in

All versions before 5.3.0 5.3.0Advisories →

Affected	Fixed in
All versions before 5.3.0	`5.3.0`Advisories →
Also listed as affected (46) `0.0.3` `0.0.4` `0.0.5` `1.3.0` `1.3.1` `1.4.0` `1.4.1` `1.4.2` `1.4.3` `2.0` `2.0.0` `2.0.1` `2.0.1.0` `2.0.2` `2.0.3` `2.0.4` `2.0.5` `2.0.6` `2.0.7` `2.0.8` `2.0.9` `2.0rc0` `2.1.0` `2.1.1` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9` `2.2.0` `2.2.1` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `3.2.0` `3.2.1.rc1` `3.2.2` `4.0.0` `5.0.0` `5.1.0`

Also listed as affected (46)

org.webjars:bootstrap Maven

All org.webjars:bootstrap advisories →

Affected	Fixed in
`3.0.0` to before 3.4.1	`3.4.1`Advisories →
Also listed as affected (22) `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.1.0` `3.1.1` `3.1.1-1` `3.1.1-2` `3.2.0` `3.2.0-1` `3.2.0-2` `3.3.0` `3.3.1` `3.3.2` `3.3.2-1` `3.3.2-2` `3.3.4` `3.3.5` `3.3.6` `3.3.7` `3.3.7-1` `3.4.0`
`4.0.0` to before 4.3.1	`4.3.1`Advisories →
Also listed as affected (9) `4.0.0` `4.0.0-1` `4.0.0-2` `4.1.0` `4.1.1` `4.1.2` `4.1.3` `4.2.1` `4.3.0`

twbs/bootstrap Packagist

All twbs/bootstrap advisories →

Affected	Fixed in
`3.0.0` to before 3.4.1	`3.4.1`Advisories →
Also listed as affected (15) `v3.0.0` `v3.0.1` `v3.0.2` `v3.0.3` `v3.1.0` `v3.1.1` `v3.2.0` `v3.3.0` `v3.3.1` `v3.3.2` `v3.3.4` `v3.3.5` `v3.3.6` `v3.3.7` `v3.4.0`
`4.0.0` to before 4.3.1	`4.3.1`Advisories →
Also listed as affected (8) `v4.0.0` `v4.1.0` `v4.1.1` `v4.1.2` `v4.1.3` `v4.2.0` `v4.2.1` `v4.3.0`

Description

Versions of bootstrap prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.

Recommendation

For bootstrap 4.x upgrade to 4.3.1 or later. For bootstrap 3.x upgrade to 3.4.1 or later.

GHSA-9v3m-8fp8-mj99

Affected versions

bootstrap RubyGems

bootstrap-sass RubyGems

Bootstrap.Less NuGet

bootstrap NuGet

bootstrap.sass NuGet

bootstrap npm

bootstrap-sass npm

twitter-bootstrap-rails RubyGems

org.webjars:bootstrap Maven

twbs/bootstrap Packagist

Description

Recommendation

References