CVE-2025-1647: Bootstrap Vulnerable to Cross-Site Scripting in Popover and Tooltip Components
Summary
CVE-2025-1647: Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components. Affects bootstrap versions 3.4.1. No fix is published. How to fix ↓
Also tracked for
- twitter-bootstrap3 · Debian:11
The same CVE-2025-1647 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bootstrap is a widely used open-source front-end framework that enables developers to create responsive and mobile-first websites quickly. It provides a collection of CSS and JavaScript components, including modals, tooltips, and popovers, which enhance user interface design. However, the framework is currently affected by a Cross-Site Scripting (XSS) vulnerability that compromises its security.
Vulnerability Detail
The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by users. This XSS vulnerability specifically affects Bootstrap version 3.4.1. If exploited, it can lead to unauthorized actions being performed on behalf of users, data theft, and a significant compromise of user trust.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, developers can sanitize user input before rendering it in the popover and tooltip components to mitigate the risk of XSS attacks. For example, using a library like DOMPurify can help clean the input:
const cleanInput = DOMPurify.sanitize(userInput);
Conclusion
The CVE-2025-1647 vulnerability in Bootstrap poses a significant risk due to its potential for Cross-Site Scripting attacks. While no patch is currently available, developers should implement input sanitization and monitor for updates to protect their applications.
See every vulnerability recorded for bootstrap →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to data theft and unauthorized actions.
Bootstrap version 3.4.1 is affected by the CVE-2025-1647 vulnerability.
As of now, there is no publicly available patched version for Bootstrap that addresses this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions on behalf of users, data theft, and a loss of user trust in the application.
Related vulnerabilities
Recent vulnerabilities recorded for bootstrap.
