GHSA-q58r-hwc8-rm9j

Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-1647

Packages

Ecosystem	Package	Affected	Fixed in
npm	bootstrap	3.4.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-1647 advisory
https://github.com/twbs/bootstrap package
https://lists.debian.org/debian-lts-announce/2025/06/msg00001.html web
https://lists.debian.org/debian-lts-announce/2026/10/msg00023.html web
https://www.herodevs.com/vulnerability-directory/cve-2025-1647 web