Executive brief
bootstrap-tagsinput is a JavaScript library for creating interactive tag input fields in web applications. A cross-site scripting (XSS) vulnerability in the itemTitle parameter allows attackers to inject malicious scripts that execute in users' browsers, potentially stealing session cookies, capturing credentials, or defacing the web interface.
Technical details
The vulnerability is a reflected/stored cross-site scripting (CWE-79) issue in the itemTitle parameter of bootstrap-tagsinput. The library fails to properly sanitize or encode user-supplied input passed to this parameter, allowing injection of arbitrary HTML and JavaScript. The attack requires application developers to pass unsanitized user input directly to the itemTitle parameter; exploitation occurs client-side when the malicious payload is rendered in the DOM. All versions through 0.8.0 are affected. The package has been unmaintained since 2015, and no official patch is available; the recommended mitigation is to avoid using the itemTitle parameter or migrate to an actively maintained fork.
Affected products
- bootstrap-tagsinput bootstrap-tagsinput 0.8.0 and earlier
Timeline
- 2020-09-01: disclosed: Advisory published in GitHub advisory database
- 2015: other: Package last updated; no maintenance since