In short
- CVE-2025-1647 is a MEDIUM (CVSS 5.6) vulnerability affecting bootstrap.
- Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.5% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| bootstrap npm | = 3.4.1
| No fix yet |
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.
NVD description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free