Executive brief
Bootstrap is a popular front-end web development framework used to build responsive websites and applications. A reported cross-site scripting (XSS) vulnerability in the carousel component was identified but later withdrawn, as Bootstrap's security model does not include sanitization of intentionally dangerous HTML. The advisory has been officially rescinded and is not considered a security issue in Bootstrap.
Technical details
The reported vulnerability involved an alleged XSS flaw in Bootstrap's carousel component where data-slide and data-slide-to attributes could be exploited through the href attribute of anchor tags due to inadequate HTML sanitization. However, this advisory was withdrawn because Bootstrap's JavaScript is not designed to sanitize unsafe HTML—this falls outside the framework's security model. The CVE associated with this report (CVE-2024-6484) has been officially rescinded by the original reporters. No patch or mitigation is required.
Affected products
- Bootstrap Bootstrap 2.0.0 through 3.4.1
Timeline
- 2024-07-11: disclosed: Advisory published (GHSA-9mvj-f7w8-pvh2, CVE-2024-6484)
- 2025-09-11: other: Advisory withdrawn; determined to not be a vulnerability in Bootstrap