PT-2020-21231 · Bootstrap · Bootstrap-Vue

Published 2020-09-02 · Updated 2020-09-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions bootstrap-vue versions prior to 2.0.0-rc.12

Description The issue is related to insufficient input sanitization, making components vulnerable to Cross-Site Scripting through the options variable. This may lead to the execution of malicious JavaScript on the user's browser.

Recommendations Upgrade to version 2.0.0-rc.12 or later.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-C7PP-X73H-4M2V

Affected Products

Bootstrap-Vue

References · 6

• https://osv.dev/vulnerability/GHSA-c7pp-x73h-4m2v · Vendor Advisory
• https://github.com/bootstrap-vue/bootstrap-vue/commit/ba6f3f8359e257589d744f180312c09bf9f12289 · Note
• https://github.com/bootstrap-vue/bootstrap-vue/pull/2134 · Note
• https://github.com/bootstrap-vue/bootstrap-vue/issues/1974 · Note
• https://github.com/bootstrap-vue/bootstrap-vue · Note
• https://npmjs.com/advisories/770 · Note