CVE-2025-1647

XSS in Bootstrap title attribute for Tooltip and Popover

5.6 MediumFix available

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.43%Up 0.4 points since May 16, 2025

What each source reports

CVE List Score used 5.6

XSS in Bootstrap title attribute for Tooltip and Popover

Record: CVE-2025-1647
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2025-15170 5.6

Record: EUVD-2025-15170
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q58r-hwc8-rm9j 5.6

Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

Record: GHSA-q58r-hwc8-rm9j
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.6

Record: CVE-2025-1647
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-1647 5.6

Record: DEBIAN-CVE-2025-1647
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVGHSA-q58r-hwc8-rm9j 5.6

Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.

Record: GHSA-q58r-hwc8-rm9j
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-1647 5.6

Record: UBUNTU-CVE-2025-1647
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSV No score

Record: CVE-2025-1647
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2025-1647 No score

CVE-2025-1647 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2025-1647
Updated: 2026-11-02

Affected products

bootstrap

Affected packages

Affected packages
Package	Affected	Fixed
`bootstrap` npm	3.4.1 to 3.4.1	None known
`twitter-bootstrap3` Debian:12	before 3.4.1+dfsg-3+deb12u2, plus listed versions 3.4.1+dfsg-33.4.1+dfsg-3+deb12u1	3.4.1+dfsg-3+deb12u2
`twitter-bootstrap3` Debian:13	before 3.4.1+dfsg-5	3.4.1+dfsg-5
`twitter-bootstrap3` Debian:14	before 3.4.1+dfsg-5	3.4.1+dfsg-5
`twitter-bootstrap3` Debian:11	before 3.4.1+dfsg-2+deb11u2, plus listed versions 3.4.1+dfsg-23.4.1+dfsg-2+deb11u1	3.4.1+dfsg-2+deb11u2
`bootstrap` npm	Listed versions 3.4.1	None known
`@rootio/bootstrap` Root:npm	before 3.4.1-root.io.1	3.4.1-root.io.1
`bootstrap` Root:npm	before 3.4.1-aikido.1	3.4.1-aikido.1
`twitter-bootstrap3` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.3.5+dfsg-13.3.5+dfsg-23.3.6+dfsg-13.3.6+dfsg-1ubuntu0.1~esm1	None known
`twitter-bootstrap3` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.3.7+dfsg-23.3.7+dfsg-2ubuntu0.1~esm1	None known

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`twitter-bootstrap3` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 3.4.1+dfsg-13.4.1+dfsg-1ubuntu0.1~esm1	None known
`twitter-bootstrap3` Ubuntu:22.04:LTS	All versions, plus listed versions 3.4.1+dfsg-23.4.1+dfsg-2+deb11u2build0.22.04.1	None known
`twitter-bootstrap3` Ubuntu:24.04:LTS	All versions, plus listed versions 3.4.1+dfsg-33.4.1+dfsg-3+deb12u1build0.24.04.1	None known
`twitter-bootstrap3` Ubuntu:25.10	All versions, plus listed versions 3.4.1+dfsg-33.4.1+dfsg-43.4.1+dfsg-6	None known
`twitter-bootstrap3` Ubuntu:26.10	All versions, plus listed versions 3.4.1+dfsg-63.4.1+dfsg-7	None known
`twitter-bootstrap3` Ubuntu:26.04:LTS	All versions, plus listed versions 3.4.1+dfsg-6	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-1647 is a medium vulnerability (CVSS 5.6) in Bootstrap, published May 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in twitter-bootstrap3 3.4.1+dfsg-3+deb12u2.