GHSA-87mg-h5r3-hw88
Cross-Site Scripting in bootbox
GHSA-87mg-h5r3-hw88 is a vulnerability with no CVSS score yet in bootbox, published May 30, 2019. No source lists public exploit code. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.
Recommendation
Sanitize user input being passed to bootbox or consider using an alternative package.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bootboxnpm | through 5.5.2 | None known |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in bootbox
All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.
Recommendation
Sanitize user input being passed to bootbox or consider using an alternative package.
- Record
GHSA-87mg-h5r3-hw88- Weakness
- CWE-64, CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in bootbox
All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.
Recommendation
Sanitize user input being passed to bootbox or consider using an alternative package.
- Record
GHSA-87mg-h5r3-hw88- Weakness
- CWE-64, CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.