Executive brief
Bootstrap is a widely-used open-source framework for building responsive web applications. A cross-site scripting (XSS) vulnerability in its Popover and Tooltip components allows attackers to inject malicious scripts that execute in users' browsers, potentially leading to credential theft, session hijacking, or unauthorized actions performed on behalf of the user.
Technical details
The vulnerability is an improper neutralization of input during web page generation (CWE-79) in Bootstrap's Popover and Tooltip components. The affected version is 3.4.1, where user-supplied input is not properly sanitized before being rendered in these UI components. An attacker can craft malicious HTML or JavaScript payloads that are included in Popover or Tooltip content and executed when a user interacts with the affected component. The attack requires user interaction (hovering over or triggering the popover/tooltip) but does not require authentication. At the time of publication, no patched version was publicly available.
Affected products
- Bootstrap Bootstrap 3.4.1
Timeline
- 2025-05-15: disclosed
- other: No publicly available patched version at time of publication