CVE-2024-6484
Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-9mvj-f7w8-pvh2
Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability
Withdrawn Advisory
This advisory has been withdrawn because it was determined to not be a vulnerability in Bootstrap. From the CVE:
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
Original Description
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
- Record
GHSA-9mvj-f7w8-pvh2- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L - CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
- Record
CVE-2024-6484- Updated
- 2026-11-02
EUVDEUVD-2024-2311
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
- Record
EUVD-2024-2311- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
NVD No score
Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
- Record
CVE-2024-6484- Updated
- 2026-11-02
OSVGHSA-9mvj-f7w8-pvh2
Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability
Withdrawn Advisory
This advisory has been withdrawn because it was determined to not be a vulnerability in Bootstrap. From the CVE:
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
Original Description
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
- Record
GHSA-9mvj-f7w8-pvh2- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L - CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-6484
Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
- Record
UBUNTU-CVE-2024-6484- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1773360977 No score
TuxCare security update for bootstrap (2 CVEs)
TuxCare rebuilt bootstrap to address 2 CVEs. Fixed in 3.4.1-tuxcare.1.
- Record
CLSA-2026-1773360977- Updated
- 2026-11-02
OSVCLSA-2026-1773360979 No score
TuxCare security update for bootstrap (7 CVEs)
TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.2.0-tuxcare.1.
- Record
CLSA-2026-1773360979- Updated
- 2026-11-02
OSV No score
Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
- Record
CVE-2024-6484- Updated
- 2026-11-02
OSVUSN-7556-1 No score
twitter-bootstrap3, twitter-bootstrap4 vulnerabilities
It was discovered that Bootstrap did not correctly sanitize certain input in the carousel component. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6484, CVE-2024-6531)
It was discovered that Bootstrap did not correctly sanitize certain input in the button plugin. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2024-6485)
- Record
USN-7556-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bootstrapTuxCare:npm |
3.4.1-tuxcare.0 up to 3.4.1-tuxcare.1, plus listed versions 3.4.1 |
3.4.1-tuxcare.1 |
bootstrapTuxCare:npm |
3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions 3.2.0 |
3.2.0-tuxcare.1 |
twitter-bootstrap3Ubuntu:Pro:16.04:LTS |
before 3.3.6+dfsg-1ubuntu0.1~esm1, plus listed versions 3.3.5+dfsg-13.3.5+dfsg-23.3.6+dfsg-1 |
3.3.6+dfsg-1ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:Pro:18.04:LTS |
before 3.3.7+dfsg-2ubuntu0.1~esm1, plus listed versions 3.3.7+dfsg-2 |
3.3.7+dfsg-2ubuntu0.1~esm1 |
twitter-bootstrap3Ubuntu:22.04:LTS |
before 3.4.1+dfsg-2+deb11u2build0.22.04.1, plus listed versions 3.4.1+dfsg-2 |
3.4.1+dfsg-2+deb11u2build0.22.04.1 |
twitter-bootstrap3Ubuntu:24.04:LTS |
before 3.4.1+dfsg-3+deb12u1build0.24.04.1, plus listed versions 3.4.1+dfsg-3 |
3.4.1+dfsg-3+deb12u1build0.24.04.1 |
twitter-bootstrap3Ubuntu:Pro:20.04:LTS |
before 3.4.1+dfsg-1ubuntu0.1~esm1, plus listed versions 3.4.1+dfsg-1 |
3.4.1+dfsg-1ubuntu0.1~esm1 |
twitter-bootstrap4Ubuntu:Pro:20.04:LTS |
before 4.4.1+dfsg1-2ubuntu0.1~esm1, plus listed versions 4.3.1+dfsg2-44.4.1+dfsg1-14.4.1+dfsg1-2 |
4.4.1+dfsg1-2ubuntu0.1~esm1 |
twitter-bootstrap4Ubuntu:Pro:22.04:LTS |
before 4.6.0+dfsg1-4ubuntu0.1~esm1, plus listed versions 4.5.2+dfsg1-84.6.0+dfsg1-34.6.0+dfsg1-4 |
4.6.0+dfsg1-4ubuntu0.1~esm1 |
twitter-bootstrap4Ubuntu:24.04:LTS |
before 4.6.1+dfsg1-4+deb12u1build0.24.04.1, plus listed versions 4.6.1+dfsg1-4 |
4.6.1+dfsg1-4+deb12u1build0.24.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-6484 has been rejected by its source and should not be treated as a live vulnerability, published July 11, 2024. Fixed in bootstrap 3.4.1-tuxcare.1.
References
nvd.nist.gov/vuln/detail/CVE-2024-6484
herodevs.com/vulnerability-directory/cve-2024-6484
github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2024-6484.yml
security-tracker.debian.org/tracker/CVE-2024-6484