Cross-site scripting in bootstrap-select

MEDIUM 6.1CVE-2019-20921 · GHSA-7c82-mp33-r854 · GHSA-9r7h-6639-v5mw · Published 30/09/2020 · updated 17/06/2026

In short

CVE-2019-20921 is a MEDIUM (CVSS 6.1) vulnerability affecting bootstrap-select, bootstrap-select (snapappointments), bootstrap-select.
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.9% of all vulnerabilities.
Fix: update to 1.13.6 or later.

Package	Affected versions	Patched versions
bootstrap-select NuGet	`< 1.13.6`	`1.13.6`
bootstrap-select snapappointments	`< 1.13.6`	`1.13.6`
bootstrap-select npm	`< 1.13.6`	`1.13.6`

Description

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

NVD description

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

References

nvd.nist.gov/vuln/detail/CVE-2019-20921 · ADVISORY
snapappointments/bootstrap-select · WEB
snapappointments/bootstrap-select commit ab6e068 · WEB
snapappointments/bootstrap-select · PACKAGE
issues.jtl-software.de/issues/SHOP-7964 · WEB
snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457 · WEB
GitHub Advisory GHSA-9r7h-6639-v5mw · Third Party Advisory
npmjs.com/advisories/1522 · Third Party Advisory
dimpu/ngx-md · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

bootstrap-select

NuGet

< 1.13.6

1.13.6

bootstrap-select

snapappointments

< 1.13.6

1.13.6

bootstrap-select

npm

< 1.13.6

1.13.6

Description

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

NVD description

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.