Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

GHSA-9v3m-8fp8-mj99

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-9v3m-8fp8-mj99

Bootstrap Vulnerable to Cross-Site Scripting Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript. ## Recommendation For `bootstrap` 4.x upgrade to 4.3.1 or later. For `bootstrap` 3.x upgrade to 3.4.1 or later.

gitlab/gem/bootstrap/CVE-2019-8331

Bootstrap Vulnerable to Cross-Site Scripting Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.

gitlab/gem/bootstrap-sass/CVE-2019-8331

Bootstrap Vulnerable to Cross-Site Scripting Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.

gitlab/gem/twitter-bootstrap-rails/CVE-2019-8331

Bootstrap Vulnerable to Cross-Site Scripting Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.

ruby_advisory_db/gems/bootstrap/CVE-2019-8331

XSS vulnerability in bootstrap In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

ruby_advisory_db/gems/bootstrap-sass/CVE-2019-8331

XSS vulnerability in bootstrap-sass In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

ruby_advisory_db/gems/twitter-bootstrap-rails/CVE-2019-8331

twitter-bootstrap-rails vulnerable to Cross-Site Scripting (XSS) The seyhunak/twitter-bootstrap-rails gem includes a vendored version of the Bootstrap JavaScript library. In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. The most recent version of this gem, 5.0.0, includes Bootstrap v 3.3.6. All versions of Bootstrap before v 3.4.1 are affected by this vulnerability. All versions of this gem are affected. # Workarounds Until this gem is updated to use Bootstrap v3.4.1, users can replace it with the official Twitter-maintained gems, `bootstrap-sass` (version 3.4.1) or `bootstrap` (bootstrap 4 and 5).