# CVE-2024-6485: Bootstrap Cross-Site Scripting in data-* attributes

Source: https://junglewise.ai/threats/cve-2024-6485-bootstrap-cross-site-scripting-in-data-attributes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-07-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-6485 · Severity: low · CVSS 3.1 · Published 2024-07-11

Bootstrap is a widely-used open-source framework for building responsive web interfaces. This vulnerability allows attackers to inject malicious JavaScript code through data-* attributes (particularly data-loading-text on buttons), which executes when users interact with affected components. An attacker could exploit this to steal session cookies, redirect users to malicious sites, or deface web pages.

Technologies: [bootstrap (npm)](https://junglewise.ai/threats/technologies/bootstrap). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-6485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6485 being exploited in the wild.

**How severe is CVE-2024-6485?** Low severity, with a CVSS score of 3.1, published 11 July 2024.

**Which products and versions are affected?** bootstrap (npm) SEMVER:introduced=1.4.0,last_affected=3.4.1.

**Is there a fix for CVE-2024-6485?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-6485 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-6485?** Check whether you run bootstrap (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Stored/Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in Bootstrap's button plugin, where the data-loading-text attribute is not properly sanitized. Malicious JavaScript injected into the data-loading-text attribute executes when the button's loading state is triggered. The vulnerability affects Bootstrap versions 1.4.0 through 3.4.1. Attack requires user interaction (clicking the button) but no authentication. An attacker can craft a web page or modify an existing page to include a button with malicious data-loading-text, and any user who triggers the loading state will execute the injected code.

## Affected products

- Bootstrap Bootstrap 1.4.0 through 3.4.1

## Identifiers

- CVE-2024-6485
- GHSA-vxmc-5x29-h64v

## Timeline

- 2024-07-11: disclosed
- 2024-07-11: advisory: OSV and NVD publication

## References

- [https://github.com/twbs/bootstrap](https://github.com/twbs/bootstrap)

## Related threats

- [Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components](https://junglewise.ai/threats/cve-2025-1647-bootstrap-cross-site-scripting-in-popover-and-tooltip)
- [Bootstrap XSS vulnerability in carousel component](https://junglewise.ai/threats/cve-2024-6531-bootstrap-xss-vulnerability-in-carousel-component)
- [Bootstrap XSS vulnerability in carousel component (withdrawn)](https://junglewise.ai/threats/cve-2024-6484-bootstrap-xss-vulnerability-in-carousel-component-withdrawn)
- [Bootstrap XSS in tooltip and popover plugins](https://junglewise.ai/threats/cve-2019-8331-bootstrap-xss-in-tooltip-and-popover-plugins)
- [Bootstrap XSS in tooltip and popover data-template attribute](https://junglewise.ai/threats/bootstrap-xss-in-tooltip-and-popover-data-template-attribute-7ae47d11)