CVE-2014-4920
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails
The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a reflected cross-site scripting (XSS) attack. This flaw exists because the bootstrap_flash helper method does not validate input when handling flash messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
What each source reports
GitHub AdvisoriesGHSA-vpqv-mqvc-pcx2 No score
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails
The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a reflected cross-site scripting (XSS) attack. This flaw exists because the bootstrap_flash helper method does not validate input when handling flash messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
- Record
GHSA-vpqv-mqvc-pcx2- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vpqv-mqvc-pcx2 No score
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails
The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a reflected cross-site scripting (XSS) attack. This flaw exists because the bootstrap_flash helper method does not validate input when handling flash messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
- Record
GHSA-vpqv-mqvc-pcx2- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
twitter-bootstrap-railsRubyGems |
before 3.2.0 | 3.2.0 |
twitter-bootstrap-railsRubyGems |
before 3.2.0, plus listed versions 0.0.30.0.40.0.51.3.01.3.1 Show 35 moreShow less1.4.01.4.11.4.21.4.32.02.0.02.0.12.0.1.02.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.0rc02.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.12.2.32.2.42.2.52.2.62.2.72.2.8 |
3.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-4920 is a vulnerability with no CVSS score yet in twitter-bootstrap-rails, published March 16, 2023. No source lists public exploit code. Fixed in twitter-bootstrap-rails 3.2.0.