CVE-2024-6485: Bootstrap Cross-Site Scripting (XSS) Vulnerability in Data Attributes
Summary
CVE-2024-6485: Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes. Affects bootstrap versions >= 1.4.0, < 3.4.1. Fixed in 3.4.1. How to fix ↓
Also tracked for
- twitter-bootstrap3 · Debian:11
The same CVE-2024-6485 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bootstrap is a widely-used open-source front-end framework that facilitates the development of responsive and mobile-first websites. It provides a collection of CSS and JavaScript components, including buttons, forms, and navigation bars, which help developers create visually appealing and functional web applications. The framework is known for its ease of use and extensive customization options. However, a security vulnerability has been identified in Bootstrap that affects the data-loading-text attribute within the button plugin, potentially exposing applications to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the ability to inject malicious JavaScript code into the data-loading-text attribute of Bootstrap buttons. When the button's loading state is triggered, the injected code is executed, which can lead to unauthorized actions, data theft, or other malicious activities. This XSS vulnerability is categorized under CWE-79, indicating its nature as a cross-site scripting issue. The severity of this vulnerability is rated as moderate, with a CVSS score of 6.4, highlighting the potential risk it poses to affected applications.
How To Fix
Latest published version: 5.3.8 as of 23 Oct 2026
npm install bootstrap@5.3.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.1
This is the first release that contains the fix.
npm install bootstrap@3.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize any user input that may be used in the data-loading-text attribute to prevent the execution of malicious scripts. Additionally, avoid using dynamic content in this attribute until the package is updated.
Conclusion
The Bootstrap Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-6485 poses a moderate risk to applications using affected versions of the framework. It is crucial for developers to update to the patched version 3.4.1 to safeguard their applications against potential XSS attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bootstrap →
FAQ
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities, to check if your application is affected by this vulnerability.
The risks include unauthorized access to user data, session hijacking, and the execution of malicious actions on behalf of users, which can compromise the integrity of your application.
Yes, you can sanitize user inputs and avoid using dynamic content in the affected attribute as a temporary measure until you can apply the update.
More information can be found in the official Bootstrap repository and security advisories, as well as on vulnerability databases like Vulert.
Related vulnerabilities
Recent vulnerabilities recorded for bootstrap.
