CVE-2018-14041: Bootstrap Cross-site Scripting vulnerability
Summary
CVE-2018-14041: Bootstrap Cross-site Scripting vulnerability. Affects bootstrap versions >= 4.0.0, < 4.1.2. Fixed in 4.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bootstrap is a popular front-end framework used for developing responsive and mobile-first websites. It provides a set of CSS and JavaScript components that help in creating a consistent and visually appealing user interface. This vulnerability affects versions of Bootstrap before 4.1.2. Bootstrap's scrollspy feature allows developers to automatically update navigation elements based on scroll position. However, an XSS (Cross-site Scripting) vulnerability exists in the data-target property of scrollspy. This vulnerability is similar to CVE-2018-14042.
Vulnerability Detail
The XSS vulnerability in Bootstrap's scrollspy feature allows an attacker to inject malicious scripts into the data-target property. When a user interacts with the affected navigation element, the injected script is executed in the context of the user's browser. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity.
How To Fix
Latest published version: 5.3.8 as of 23 Oct 2026
npm install bootstrap@5.3.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.2
This is the first release that contains the fix.
npm install bootstrap@4.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Bootstrap is not feasible immediately, a temporary workaround is to sanitize the data-target property value before using it in the application. This can be done by implementing input validation and escaping special characters. Here's an example in JavaScript:
function sanitizeDataTarget(dataTarget) {
return dataTarget.replace(/[<>&]/g, function (c) {
return {
'<': '<',
'>': '>',
'&': '&'
}[c];
});
}
Conclusion
The XSS vulnerability in Bootstrap's scrollspy feature (CVE-2018-14041) can be mitigated by updating to version 4.1.2 or later. If immediate update is not possible, developers should sanitize the data-target property value to prevent script injection. It is important to stay updated with the latest security patches and regularly monitor for vulnerabilities in your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for bootstrap →
FAQ
Bootstrap is a front-end framework that provides CSS and JavaScript components for building responsive websites.
XSS (Cross-site Scripting) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
If your application uses Bootstrap versions before 4.1.2 and utilizes the scrollspy feature with the data-target property, it is vulnerable to XSS attacks. An attacker can exploit this vulnerability to execute malicious scripts in the context of your users' browsers.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
The vulnerability has a CVSS score of 6.1, indicating a moderate severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for bootstrap.
