Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the data-target attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the data-container property of tooltip.

References: https://github.com/twbs/bootstrap/issues/26628

Upstream Patch: https://github.com/twbs/bootstrap/pull/26630

A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the collapse data-parent attribute.

References: https://github.com/twbs/bootstrap/issues/26625

Upstream Patch: https://github.com/twbs/bootstrap/pull/26630

A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the data-target property of scrollspy.

References: https://github.com/twbs/bootstrap/issues/26627

Upstream Patch: https://github.com/twbs/bootstrap/pull/26630