CVE-2016-10735: XSS vulnerability in bootstrap
Summary
CVE-2016-10735: Bootstrap Cross-site Scripting vulnerability. Affects bootstrap across 2 version ranges.
>= 2.0.4, < 3.4.0
>= 4.0.0-beta, < 4.0.0-beta.2
Fixed in 3.4.0 or 4.0.0-beta.2, depending on the release line you run. How to fix ↓
Also tracked for
- twitter-bootstrap3 · Debian:11
The same CVE-2016-10735 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bootstrap is a popular open-source framework for building responsive and mobile-first websites. It provides a wide range of CSS and JavaScript components that help developers create visually appealing and interactive web pages. However, a vulnerability has been discovered in Bootstrap versions 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2 that allows for cross-site scripting (XSS) attacks. This vulnerability affects the data-target attribute, allowing an attacker to inject malicious code into the attribute's value.
Vulnerability Detail
The XSS vulnerability in Bootstrap's data-target attribute can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various security risks, such as stealing sensitive information, performing actions on behalf of the user, or modifying the appearance and behavior of the web page. It is important to note that this vulnerability is different from CVE-2018-14041. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 5.3.8 as of 23 Oct 2026
npm install bootstrap@5.3.8Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.4, < 3.4.03.4.0npm install bootstrap@3.4.0 -
>= 4.0.0-beta, < 4.0.0-beta.24.0.0-beta.2npm install bootstrap@4.0.0-beta.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Bootstrap is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the data-target attribute's value to prevent the execution of malicious code. This can be done by using appropriate input validation and output encoding techniques. Here is an example of how to sanitize the data-target attribute in JavaScript:
var target = document.getElementById('myElement');
var sanitizedValue = sanitize(dataTargetValue);
target.setAttribute('data-target', sanitizedValue);
Conclusion
The XSS vulnerability in Bootstrap's data-target attribute poses a security risk by allowing attackers to execute arbitrary JavaScript code in users' browsers. To mitigate this vulnerability, it is crucial to upgrade to the latest secure version of Bootstrap. Developers should also consider implementing input validation and output encoding techniques to sanitize user input and prevent the execution of malicious code. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bootstrap →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the user's browser, potentially leading to unauthorized access, data theft, or manipulation of the web page.
No, only Bootstrap versions 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2 are affected. It is recommended to upgrade to the latest secure version.
While specific exploits may not be publicly available, the existence of the vulnerability increases the risk of exploitation. It is crucial to apply the recommended fixes as soon as possible.
Yes, this vulnerability can be exploited remotely by an attacker who can trick a user into visiting a specially crafted web page or clicking on a malicious link.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bootstrap.
