CVE-2018-20676: XSS vulnerability in Bootstrap
Summary
CVE-2018-20676: XSS vulnerability that affects bootstrap. Affects bootstrap versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- twitter-bootstrap3 · Debian:11
The same CVE-2018-20676 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bootstrap is a popular front-end framework used for building responsive and mobile-first websites. It provides a set of CSS and JavaScript components that help developers create visually appealing and interactive web pages. The vulnerability identified as CVE-2018-20676 affects versions of Bootstrap prior to 3.4.0. This vulnerability allows for cross-site scripting (XSS) attacks through the tooltip data-viewport attribute.
Vulnerability Detail
The XSS vulnerability in Bootstrap arises from improper handling of user input in the tooltip data-viewport attribute. An attacker can exploit this vulnerability by injecting malicious code into the attribute, which is then executed when a user hovers over the tooltip. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially compromising sensitive user information or enabling further attacks. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Latest published version: 5.3.8 as of 23 Oct 2026
npm install bootstrap@5.3.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
npm install bootstrap@3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Bootstrap is not immediately feasible, developers can implement a workaround by manually sanitizing and validating user input before using it in the tooltip data-viewport attribute. This can be achieved by using appropriate input validation libraries or custom validation functions. Here's an example of how to sanitize user input using the DOMPurify library:
const sanitizedInput = DOMPurify.sanitize(userInput);
Conclusion
In conclusion, the XSS vulnerability (CVE-2018-20676) in Bootstrap versions prior to 3.4.0 can allow attackers to execute arbitrary JavaScript code in the context of users' browsers. To mitigate this vulnerability, it is recommended to upgrade to Bootstrap 3.4.0 or later. If immediate upgrade is not possible, developers should implement input sanitization and validation in the tooltip data-viewport attribute. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bootstrap →
FAQ
Bootstrap is a front-end framework that provides CSS and JavaScript components for building responsive and mobile-first websites.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
If your application uses a version of Bootstrap prior to 3.4.0 and utilizes the tooltip data-viewport attribute, it is vulnerable to XSS attacks. An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of your users' browsers.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for bootstrap.
