# Bootstrap XSS in tooltip and popover data-template attribute

Source: https://junglewise.ai/threats/bootstrap-xss-in-tooltip-and-popover-data-template-attribute-7ae47d11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2019-02-22

Bootstrap is a popular front-end framework used to build responsive websites and web applications. This vulnerability allows attackers to inject malicious scripts through the tooltip or popover data-template attribute, potentially compromising user sessions or stealing sensitive data displayed on affected web pages.

Technologies: [bootstrap (npm)](https://junglewise.ai/threats/technologies/bootstrap), [bootstrap-sass (npm)](https://junglewise.ai/threats/technologies/bootstrap-sass). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 22 February 2019.

**Which products and versions are affected?** bootstrap (npm) SEMVER:introduced=3.0.0,fixed=3.4.1,introduced=4.0.0,fixed=4.3.1; bootstrap-sass (npm) SEMVER:introduced=3.0.0,fixed=3.4.1.

**Is there a fix for This vulnerability?** Yes. bootstrap (npm): upgrade to 4.3.1 or later; bootstrap-sass (npm): upgrade to 3.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run bootstrap (npm) or bootstrap-sass (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bootstrap (npm): upgrade to 4.3.1 or later

  ```sh
  npm install bootstrap@4.3.1
  ```

- bootstrap-sass (npm): upgrade to 3.4.1 or later

  ```sh
  npm install bootstrap-sass@3.4.1
  ```


## Technical details

This is a cross-site scripting (XSS) vulnerability in Bootstrap 3 before version 3.4.1 and Bootstrap 4 before version 4.3.1. The vulnerability exists in the tooltip and popover components, which fail to properly sanitize the data-template attribute, allowing an attacker to inject arbitrary JavaScript code. The attack requires an application to use tooltips or popovers with user-controlled or unsanitized template data. An attacker can exploit this to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, credential theft, or malware distribution. Patches are available in Bootstrap 3.4.1 and 4.3.1.

## Affected products

- Bootstrap Bootstrap 3.0.0 to 3.4.0, 4.0.0 to 4.3.0
- Bootstrap bootstrap-sass 3.0.0 to 3.4.0

## Timeline

- 2019-02-22: disclosed
- 2019-02-13: patched: Bootstrap 4.3.1 and 3.4.1 released
- 2023-03-14: other: Advisory withdrawn from GitHub Advisory Database

## Related threats

- [Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components](https://junglewise.ai/threats/cve-2025-1647-bootstrap-cross-site-scripting-in-popover-and-tooltip)
- [Bootstrap XSS vulnerability in carousel component](https://junglewise.ai/threats/cve-2024-6531-bootstrap-xss-vulnerability-in-carousel-component)
- [Bootstrap XSS vulnerability in carousel component (withdrawn)](https://junglewise.ai/threats/cve-2024-6484-bootstrap-xss-vulnerability-in-carousel-component-withdrawn)
- [Bootstrap Cross-Site Scripting in data-* attributes](https://junglewise.ai/threats/cve-2024-6485-bootstrap-cross-site-scripting-in-data-attributes)
- [Bootstrap XSS in tooltip and popover plugins](https://junglewise.ai/threats/cve-2019-8331-bootstrap-xss-in-tooltip-and-popover-plugins)