Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

보통 5.6CVE-2025-1647 · GHSA-q58r-hwc8-rm9j · Published 15/05/2025 · updated 09/10/2026

요약

CVE-2025-1647은(는) bootstrap에 영향을 주는 보통 (CVSS 5.6) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.43%, 전체 취약점의 37.5%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
bootstrap npm	`= 3.4.1`	No fix yet

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

NVD description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.

References

nvd.nist.gov/vuln/detail/CVE-2025-1647 · ADVISORY
twbs/bootstrap · PACKAGE
lists.debian.org/debian-lts-announce/2025/06/msg00001.html · WEB
lists.debian.org/debian-lts-announce/2026/10/msg00023.html · WEB
herodevs.com/vulnerability-directory/cve-2025-1647 · WEB

bootstrap의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

bootstrap

npm

= 3.4.1

No fix yet

Description

NVD description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.

bootstrap의 다른 취약점

모두 보기 →