GHSA-7c82-mp33-r854

Cross-site scripting in bootstrap-select

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-20921

Packages

Ecosystem	Package	Affected	Fixed in
npm	bootstrap-select	< 1.13.6	1.13.6
NuGet	bootstrap-select	< 1.13.6	1.13.6

Details

As written in the advisory (Markdown source, shown as plain text).

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-20921 advisory
https://github.com/snapappointments/bootstrap-select/issues/2199 web
https://github.com/snapappointments/bootstrap-select/commit/ab6e068748040cf3cda5859f6349b382402b8767 web
https://github.com/snapappointments/bootstrap-select package
https://issues.jtl-software.de/issues/SHOP-7964 web
https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457 web