Junglewise Threat Intelligence

CVE-2025-47204: Bootstrap Multiselect Reflective XSS and CSRF via arbitrary POST data

CVE-2025-47204 · Severity: low · CVSS 3.1 · Published 2025-05-13

Vendors: npm.

Executive brief

Bootstrap Multiselect is a popular JavaScript library that extends dropdown controls for selecting multiple items. The library included a PHP example file that echoes untrusted POST data without sanitization. If developers copy this example into production without modification, it enables attackers to inject malicious scripts and trick users into performing unintended actions through forged requests.

Technical details

The vulnerability stems from the post.php example file in Bootstrap Multiselect 1.1.2 and earlier versions, which directly echoes arbitrary POST parameters to the response without HTML encoding or validation. This creates a Reflective Cross-Site Scripting (XSS) vulnerability (CWE-79) that can be chained with Cross-Site Request Forgery (CSRF, CWE-352) attacks. An attacker can craft a malicious URL or form that, when clicked by an authenticated user, submits arbitrary POST data containing JavaScript payloads. The vulnerability requires user interaction (clicking a link/form) but no authentication on the vulnerable endpoint. The fix is available in version 2.0.0, which either removes the vulnerable example file or sanitizes the output.

Affected products

  • Bootstrap Multiselect bootstrap-multiselect before 2.0.0

Timeline

  • 2025-05-13: disclosed
  • 2025-05-15: patched: Fix released in version 2.0.0

References