Executive brief
Bootstrap is a popular front-end framework used to build responsive websites and applications. A now-withdrawn advisory claimed the carousel component contained a cross-site scripting (XSS) vulnerability that could allow attackers to inject malicious code into web pages. However, this advisory was retracted because Bootstrap does not sanitize HTML by design—users are responsible for validating input themselves.
Technical details
The reported vulnerability (CVE-2024-6531) involved improper handling of the data-slide and data-slide-to attributes in Bootstrap's carousel component, potentially allowing XSS via crafted href attributes in anchor tags. The advisory was withdrawn because Bootstrap's JavaScript library is not designed to sanitize user-supplied HTML content; it is the application developer's responsibility to validate and escape input before rendering. No active exploit is known, and the associated CVE was rescinded.
Affected products
- Bootstrap Bootstrap 4.0.0 through 4.6.2
Timeline
- 2024-07-11: disclosed: Advisory published on GitHub and NVD
- 2025-10-09: other: Advisory withdrawn; CVE rescinded as not a security issue in Bootstrap