CVE-2024-6485
XSS in Bootstrap button component
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
XSS in Bootstrap button component
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
CVE-2024-6485- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-2429
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
EUVD-2024-2429- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vxmc-5x29-h64v
Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
GHSA-vxmc-5x29-h64v- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
CVE-2024-6485- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-6485
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
DEBIAN-CVE-2024-6485- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-vxmc-5x29-h64v
Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
GHSA-vxmc-5x29-h64v- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 18 moreShow less
OSVUBUNTU-CVE-2024-6485
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
UBUNTU-CVE-2024-6485- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVAZL-105104 No score
CVE-2024-6485 affecting package python-openstackdocstheme 3.0.0-9
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
AZL-105104- Updated
- 2026-11-05
OSVAZL-105134 No score
CVE-2024-6485 affecting package ceph 18.2.2-13
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
AZL-105134- Updated
- 2026-11-02
OSVAZL-105158 No score
CVE-2024-6485 affecting package fluent-bit 3.1.10-7
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
AZL-105158- Updated
- 2026-11-02
OSVAZL-105206 No score
CVE-2024-6485 affecting package ntopng 5.2.1-7
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
AZL-105206- Updated
- 2026-11-05
OSVAZL-105272 No score
CVE-2024-6485 affecting package pytorch 2.2.2-17
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
AZL-105272- Updated
- 2026-11-02
OSVAZL-71317 No score
CVE-2024-6485 affecting package reaper for versions less than 3.1.1-22
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
AZL-71317- Updated
- 2026-11-02
OSVCLSA-2026-1773360977 No score
TuxCare security update for bootstrap (2 CVEs)
TuxCare rebuilt bootstrap to address 2 CVEs. Fixed in 3.4.1-tuxcare.1.
- Record
CLSA-2026-1773360977- Updated
- 2026-11-02
OSVCLSA-2026-1773360979 No score
TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.2.0-tuxcare.1.
- Record
CLSA-2026-1773360979- Updated
- 2026-11-02
OSVCLSA-2026-1780447821 No score
TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.6-tuxcare.1.
- Record
CLSA-2026-1780447821- Updated
- 2026-11-02
OSVCLSA-2026-1782349132 No score
TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.7-tuxcare.1.
- Record
CLSA-2026-1782349132- Updated
- 2026-11-02
OSVCLSA-2026-1787224704 No score
TuxCare security update for bootstrap (5 CVEs)
TuxCare rebuilt bootstrap to address 5 CVEs. Fixed in 3.0.0-tuxcare.1.
- Record
CLSA-2026-1787224704- Updated
- 2026-11-02
OSVCLSA-2026-1787224839 No score
TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.2-tuxcare.1.
- Record
CLSA-2026-1787224839- Updated
- 2026-11-02
OSVCLSA-2026-1787224853 No score
TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.1-tuxcare.1.
- Record
CLSA-2026-1787224853- Updated
- 2026-11-02
OSVCLSA-2026-1787226168 No score
TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.5-tuxcare.1.
- Record
CLSA-2026-1787226168- Updated
- 2026-11-02
OSV No score
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
- Record
CVE-2024-6485- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-6485 No score
CVE-2024-6485 in @rootio/bootstrap - Patched by Root
Root has patched CVE-2024-6485 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-6485- Updated
- 2026-11-02
OSVUSN-7556-1 No score
twitter-bootstrap3, twitter-bootstrap4 vulnerabilities
It was discovered that Bootstrap did not correctly sanitize certain input in the carousel component. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6484, CVE-2024-6531)
It was discovered that Bootstrap did not correctly sanitize certain input in the button plugin. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6485)
- Record
USN-7556-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bootstrapnpm |
1.4.0 to 3.4.1 | None known |
python-openstackdocsthemeAzure Linux:3 |
through 3.0.0-9 | None known |
cephAzure Linux:3 |
through 18.2.2-13 | None known |
fluent-bitAzure Linux:3 |
through 3.1.10-7 | None known |
ntopngAzure Linux:3 |
through 5.2.1-7 | None known |
pytorchAzure Linux:3 |
through 2.2.2-17 | None known |
reaperAzure Linux:2 |
before 3.1.1-22 | 3.1.1-22 |
bootstrapTuxCare:npm From an advisory covering 2 CVEs |
3.4.1-tuxcare.0 up to 3.4.1-tuxcare.1, plus listed versions 3.4.1 |
3.4.1-tuxcare.1 |
bootstrapTuxCare:npm From an advisory covering 7 CVEs |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
bootstrapTuxCare:npm From an advisory covering 7 CVEs |
3.3.6-tuxcare.0 up to 3.3.6-tuxcare.1, plus listed versions 3.3.6 |
3.3.6-tuxcare.1 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bootstrapTuxCare:npm From an advisory covering 7 CVEs |
3.3.7-tuxcare.0 up to 3.3.7-tuxcare.1, plus listed versions 3.3.7 |
3.3.7-tuxcare.1 |
bootstrapTuxCare:npm From an advisory covering 5 CVEs |
3.0.0-tuxcare.0 up to 3.0.0-tuxcare.1, plus listed versions 3.0.0 |
3.0.0-tuxcare.1 |
bootstrapTuxCare:npm From an advisory covering 7 CVEs |
3.3.2-tuxcare.0 up to 3.3.2-tuxcare.1, plus listed versions 3.3.2 |
3.3.2-tuxcare.1 |
bootstrapTuxCare:npm From an advisory covering 7 CVEs |
3.3.1-tuxcare.0 up to 3.3.1-tuxcare.1, plus listed versions 3.3.1 |
3.3.1-tuxcare.1 |
bootstrapTuxCare:npm From an advisory covering 7 CVEs |
3.3.5-tuxcare.0 up to 3.3.5-tuxcare.1, plus listed versions 3.3.5 |
3.3.5-tuxcare.1 |
twitter-bootstrap3Debian:12 |
before 3.4.1+dfsg-3+deb12u1, plus listed versions 3.4.1+dfsg-3 |
3.4.1+dfsg-3+deb12u1 |
twitter-bootstrap3Debian:13 |
before 3.4.1+dfsg-4 | 3.4.1+dfsg-4 |
twitter-bootstrap3Debian:14 |
before 3.4.1+dfsg-4 | 3.4.1+dfsg-4 |
twitter-bootstrap3Debian:11 |
before 3.4.1+dfsg-2+deb11u1, plus listed versions 3.4.1+dfsg-2 |
3.4.1+dfsg-2+deb11u1 |
@rootio/bootstrapRoot:npm |
before 3.4.1-root.io.1 | 3.4.1-root.io.1 |
bootstrapRoot:npm |
before 3.4.1-aikido.1 | 3.4.1-aikido.1 |
twitter-bootstrap3Ubuntu:Pro:16.04:LTS |
before 3.3.6+dfsg-1ubuntu0.1~esm1, plus listed versions 3.3.5+dfsg-13.3.5+dfsg-23.3.6+dfsg-1 |
3.3.6+dfsg-1ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:Pro:18.04:LTS |
before 3.3.7+dfsg-2ubuntu0.1~esm1, plus listed versions 3.3.7+dfsg-2 |
3.3.7+dfsg-2ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:22.04:LTS |
before 3.4.1+dfsg-2+deb11u2build0.22.04.1, plus listed versions 3.4.1+dfsg-2 |
3.4.1+dfsg-2+deb11u2build0.22.04.1 |
twitter-bootstrap3Ubuntu:24.04:LTS |
before 3.4.1+dfsg-3+deb12u1build0.24.04.1, plus listed versions 3.4.1+dfsg-3 |
3.4.1+dfsg-3+deb12u1build0.24.04.1 |
twitter-bootstrap3Ubuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 3.3.6+dfsg-1ubuntu0.1~esm1, plus listed versions 3.3.5+dfsg-13.3.5+dfsg-23.3.6+dfsg-1 |
3.3.6+dfsg-1ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 3.3.7+dfsg-2ubuntu0.1~esm1, plus listed versions 3.3.7+dfsg-2 |
3.3.7+dfsg-2ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 3.4.1+dfsg-1ubuntu0.1~esm1, plus listed versions 3.4.1+dfsg-1 |
3.4.1+dfsg-1ubuntu0.1~esm1 |
twitter-bootstrap4Ubuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 4.4.1+dfsg1-2ubuntu0.1~esm1, plus listed versions 4.3.1+dfsg2-44.4.1+dfsg1-14.4.1+dfsg1-2 |
4.4.1+dfsg1-2ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:22.04:LTS From an advisory covering 3 CVEs |
before 3.4.1+dfsg-2+deb11u2build0.22.04.1, plus listed versions 3.4.1+dfsg-2 |
3.4.1+dfsg-2+deb11u2build0.22.04.1 |
twitter-bootstrap4Ubuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 4.6.0+dfsg1-4ubuntu0.1~esm1, plus listed versions 4.5.2+dfsg1-84.6.0+dfsg1-34.6.0+dfsg1-4 |
4.6.0+dfsg1-4ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:24.04:LTS From an advisory covering 3 CVEs |
before 3.4.1+dfsg-3+deb12u1build0.24.04.1, plus listed versions 3.4.1+dfsg-3 |
3.4.1+dfsg-3+deb12u1build0.24.04.1 |
twitter-bootstrap4Ubuntu:24.04:LTS From an advisory covering 3 CVEs |
before 4.6.1+dfsg1-4+deb12u1build0.24.04.1, plus listed versions 4.6.1+dfsg1-4 |
4.6.1+dfsg1-4+deb12u1build0.24.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Yumeae/Bootstrap-with-XSS | 2025-07-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-6485 is a medium vulnerability (CVSS 6.4) in Bootstrap, published July 11, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in reaper 3.1.1-22.