Executive brief
bootstrap-table is a popular library for creating interactive data tables in web applications. A vulnerability in its input sanitization allows attackers to inject malicious scripts when array data is passed instead of strings, potentially enabling account takeover or data theft from users viewing affected pages.
Technical details
The escapeHTML function in bootstrap-table fails to properly sanitize inputs when they are arrays rather than strings, resulting in a type confusion vulnerability (CWE-843). Even when the escape attribute is configured to enable HTML sanitization, an attacker can bypass this protection by crafting array-based payloads containing malicious JavaScript. The vulnerability requires user interaction (UI:R) and a specific attack complexity (AC:H) to exploit. An attacker can achieve limited impact—reading sensitive information (C:L)—but cannot modify data or compromise availability. The vulnerable code is located in src/utils/index.js at line 218.
Affected products
- wenzhixin bootstrap-table through 1.19.0
Timeline
- 2021-11-08: disclosed: Advisory published
- 2021-11-03: other: NVD published