CVE-2018-14040: Bootstrap XSS Vulnerability
Summary
CVE-2018-14040: Bootstrap vulnerable to Cross-Site Scripting (XSS). Affects bootstrap across 2 version ranges.
>= 2.3.0, < 3.4.0
>= 4.0.0, < 4.1.2
Fixed in 3.4.0 or 4.1.2, depending on the release line you run. How to fix ↓
Also tracked for
- twitter-bootstrap3 · Debian:11
The same CVE-2018-14040 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bootstrap is a popular open-source framework used for building responsive and mobile-first websites. It provides a collection of CSS and JavaScript components that simplify the development process. However, versions of Bootstrap before 4.1.2 are vulnerable to a Cross-Site Scripting (XSS) attack. This vulnerability can be exploited through the collapse data-parent attribute, allowing an attacker to inject malicious code into a web page.
Vulnerability Detail
The XSS vulnerability in Bootstrap 4.x versions before 4.1.2 arises from improper input sanitization in the collapse data-parent attribute. An attacker can craft a malicious payload and inject it into a web page, potentially leading to the execution of arbitrary JavaScript code in the context of the victim's browser. This can result in various consequences, such as stealing sensitive information, session hijacking, or defacement of the affected website.
How To Fix
Latest published version: 5.3.8 as of 23 Oct 2026
npm install bootstrap@5.3.8Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 3.4.03.4.0npm install bootstrap@3.4.0 -
>= 4.0.0, < 4.1.24.1.2npm install bootstrap@4.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version of Bootstrap is not immediately feasible, a temporary workaround is to manually sanitize any user-generated content before displaying it on web pages. This can be achieved by using appropriate HTML encoding or escaping techniques to neutralize any potential XSS payloads.
Conclusion
The XSS vulnerability in Bootstrap versions before 4.1.2 poses a significant risk to web applications utilizing the framework. To mitigate this vulnerability, it is crucial to upgrade to Bootstrap version 4.1.2 or later. Additionally, implementing proper input sanitization techniques can provide temporary protection until the upgrade is performed. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for bootstrap →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate website content, or perform other malicious actions.
By crafting a malicious payload and injecting it into a web page that utilizes the vulnerable collapse data-parent attribute, an attacker can execute arbitrary JavaScript code in the context of the victim's browser. This can lead to various security risks and compromise the integrity of the affected website.
While specific exploits targeting this vulnerability have not been disclosed, it is important to promptly apply the recommended security patches to mitigate the risk of exploitation. Attackers are constantly evolving their techniques, so it is crucial to stay up-to-date with security updates.
No, only versions of Bootstrap before 4.1.2 are vulnerable to this XSS issue. It is crucial to update to the latest patched version to ensure the security of your application.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious code into a web page and target unsuspecting users who visit the compromised page. It is essential to address this vulnerability promptly to protect users and maintain the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for bootstrap.
