Executive brief
bootstrap-vue is a popular UI component library for Vue.js applications. Versions before 2.0.0-rc.12 fail to properly sanitize user-supplied HTML in form-select options, allowing attackers to inject and execute malicious JavaScript in users' browsers. This could lead to session hijacking, credential theft, or defacement of the application.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw caused by insufficient input sanitization in the form-select component's options handling. When the `:options` prop receives user-controlled data, HTML script tags embedded in option values are not stripped before being inserted into the DOM, allowing arbitrary JavaScript execution. The attack requires the attacker to control data passed to the component's options prop (typically through application logic or user input). The fix, merged in November 2018 and released in 2.0.0-rc.12, implements a utility function to strip HTML script tags from injected content before DOM insertion.
Affected products
- bootstrap-vue bootstrap-vue prior to 2.0.0-rc.12
Timeline
- 2020-09-02: disclosed: GHSA-c7pp-x73h-4m2v published
- 2018-11-04: patched: Security fix merged in PR #2134, released in 2.0.0-rc.12