CVE-2019-20921: XSS
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
Other sources
Versions of bootstrap-select prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS). The package does not escape title values on <option> tags. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
References:
https://github.com/advisories/GHSA-9r7h-6639-v5mw
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-20921?
CVE-2019-20921 is classified as a medium severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2019-20921?
To fix CVE-2019-20921, update to bootstrap-select version 1.13.6 or later.
What types of applications are affected by CVE-2019-20921?
CVE-2019-20921 affects applications using bootstrap-select versions prior to 1.13.6, particularly those using the library for handling dropdowns.
What is Cross-Site Scripting (XSS) in the context of CVE-2019-20921?
In the context of CVE-2019-20921, Cross-Site Scripting (XSS) allows attackers to execute arbitrary JavaScript in the user's browser, potentially compromising user data.
Who is impacted by CVE-2019-20921?
Users of applications that incorporate vulnerable versions of bootstrap-select are impacted by CVE-2019-20921.