{"id":"CVE-2024-6485","aliases":["AZL-105104","AZL-105134","AZL-105158","AZL-105206","AZL-105272","AZL-71317","CLSA-2026-1773360977","CLSA-2026-1773360979","CLSA-2026-1780447821","CLSA-2026-1782349132","CLSA-2026-1787224704","CLSA-2026-1787224839","CLSA-2026-1787224853","CLSA-2026-1787226168","DEBIAN-CVE-2024-6485","DLA-4124-1","EUVD-2024-2429","GHSA-vxmc-5x29-h64v","ROOT-APP-NPM-CVE-2024-6485","UBUNTU-CVE-2024-6485","USN-7556-1"],"status":"published","title":"XSS in Bootstrap button component","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00494,"percentile":0.42685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2024-07-11T17:08:08Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"Yumeae/Bootstrap-with-XSS","title":"Yumeae/Bootstrap-with-XSS","date":"2025-07-21","url":"https://github.com/Yumeae/Bootstrap-with-XSS"}],"fixes":[{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-22"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twitter-bootstrap3","fixed_in":["3.4.1+dfsg-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twitter-bootstrap3","fixed_in":["3.4.1+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twitter-bootstrap3","fixed_in":["3.4.1+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"twitter-bootstrap3","fixed_in":["3.4.1+dfsg-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/bootstrap","fixed_in":["3.4.1-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"bootstrap","fixed_in":["3.4.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twitter-bootstrap3","fixed_in":["3.3.6+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twitter-bootstrap3","fixed_in":["3.3.7+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"twitter-bootstrap3","fixed_in":["3.4.1+dfsg-2+deb11u2build0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"twitter-bootstrap3","fixed_in":["3.4.1+dfsg-3+deb12u1build0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"last_affected":"3.4.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-openstackdocstheme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"18.2.2-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.10-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ntopng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.2.1-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"pytorch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.2.2-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-22"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1-tuxcare.0"},{"fixed":"3.4.1-tuxcare.1"}]}],"versions":["3.4.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.6-tuxcare.0"},{"fixed":"3.3.6-tuxcare.1"}]}],"versions":["3.3.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.7-tuxcare.0"},{"fixed":"3.3.7-tuxcare.1"}]}],"versions":["3.3.7"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-tuxcare.0"},{"fixed":"3.0.0-tuxcare.1"}]}],"versions":["3.0.0"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2-tuxcare.0"},{"fixed":"3.3.2-tuxcare.1"}]}],"versions":["3.3.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.1-tuxcare.0"},{"fixed":"3.3.1-tuxcare.1"}]}],"versions":["3.3.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.5-tuxcare.0"},{"fixed":"3.3.5-tuxcare.1"}]}],"versions":["3.3.5"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-3+deb12u1"}]}],"versions":["3.4.1+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-2+deb11u1"}]}],"versions":["3.4.1+dfsg-2"]},{"source":"osv","ecosystem":"npm","package":"bootstrap","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"last_affected":"3.4.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.6+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.3.5+dfsg-1","3.3.5+dfsg-2","3.3.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7+dfsg-2ubuntu0.1~esm1"}]}],"versions":["3.3.7+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-2+deb11u2build0.22.04.1"}]}],"versions":["3.4.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-3+deb12u1build0.24.04.1"}]}],"versions":["3.4.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.6+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.3.5+dfsg-1","3.3.5+dfsg-2","3.3.6+dfsg-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7+dfsg-2ubuntu0.1~esm1"}]}],"versions":["3.3.7+dfsg-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.4.1+dfsg-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"twitter-bootstrap4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["4.3.1+dfsg2-4","4.4.1+dfsg1-1","4.4.1+dfsg1-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-2+deb11u2build0.22.04.1"}]}],"versions":["3.4.1+dfsg-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"twitter-bootstrap4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0+dfsg1-4ubuntu0.1~esm1"}]}],"versions":["4.5.2+dfsg1-8","4.6.0+dfsg1-3","4.6.0+dfsg1-4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twitter-bootstrap3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-3+deb12u1build0.24.04.1"}]}],"versions":["3.4.1+dfsg-3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twitter-bootstrap4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1+dfsg1-4+deb12u1build0.24.04.1"}]}],"versions":["4.6.1+dfsg1-4"],"bundled":3}],"products":[{"vendor":"bootstrap","product":"bootstrap"},{"vendor":"bootstrap-sass","product":"bootstrap-sass"},{"vendor":"getbootstrap","product":"bootstrap"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2024-6485","tags":["x_transferred","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00020.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6485","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vxmc-5x29-h64v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6485","tags":["advisory"]},{"url":"https://github.com/twbs/bootstrap","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-6485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6485","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7556-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-6484","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6531","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-6485","title":"XSS in Bootstrap button component","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:08:08.224Z","modified":"2025-11-03T19:34:34.709Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-2429","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:08:08Z","modified":"2025-11-03T19:34:34Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-vxmc-5x29-h64v","title":"Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T18:31:14Z","modified":"2025-11-03T21:31:11Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2024-6485","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17.24Z","modified":"2026-06-17T08:18:06.253Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:12.994089Z"}],"osv":[{"id":"DEBIAN-CVE-2024-6485","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17.24Z","modified":"2026-11-02T12:03:12.438820342Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-vxmc-5x29-h64v","title":"Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T18:31:14Z","modified":"2026-09-10T03:50:17.018129226Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2024-6485","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:00Z","modified":"2026-02-04T03:23:29.330463Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"AZL-105104","title":"CVE-2024-6485 affecting package python-openstackdocstheme 3.0.0-9","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"AZL-105134","title":"CVE-2024-6485 affecting package ceph 18.2.2-13","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-105158","title":"CVE-2024-6485 affecting package fluent-bit 3.1.10-7","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-105206","title":"CVE-2024-6485 affecting package ntopng 5.2.1-7","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"AZL-105272","title":"CVE-2024-6485 affecting package pytorch 2.2.2-17","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-71317","title":"CVE-2024-6485 affecting package reaper for versions less than 3.1.1-22","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17Z","modified":"2026-04-21T04:36:33.92748Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"CLSA-2026-1773360977","title":"TuxCare security update for bootstrap (2 CVEs)","description":"TuxCare rebuilt bootstrap to address 2 CVEs. Fixed in 3.4.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-23T13:58:17.777208483Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773360979","title":"TuxCare security update for bootstrap (7 CVEs)","description":"TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-25T07:28:08.188816825Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1780447821","title":"TuxCare security update for bootstrap (7 CVEs)","description":"TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.581100189Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782349132","title":"TuxCare security update for bootstrap (7 CVEs)","description":"TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:10.498523076Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1787224704","title":"TuxCare security update for bootstrap (5 CVEs)","description":"TuxCare rebuilt bootstrap to address 5 CVEs. Fixed in 3.0.0-tuxcare.1.","status":"published","published":"2026-08-20T11:18:24Z","modified":"2026-10-15T09:45:32.987668567Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787224839","title":"TuxCare security update for bootstrap (7 CVEs)","description":"TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.2-tuxcare.1.","status":"published","published":"2026-08-20T11:20:39Z","modified":"2026-10-15T09:45:32.88553568Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787224853","title":"TuxCare security update for bootstrap (7 CVEs)","description":"TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.1-tuxcare.1.","status":"published","published":"2026-08-20T11:20:53Z","modified":"2026-10-15T09:45:32.289464916Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787226168","title":"TuxCare security update for bootstrap (7 CVEs)","description":"TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.5-tuxcare.1.","status":"published","published":"2026-08-20T11:42:48Z","modified":"2026-10-15T09:45:32.784321637Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CVE-2024-6485","description":"A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.","status":"published","published":"2024-07-11T17:15:17Z","modified":"2026-04-10T05:19:22.459344Z","updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"DLA-4124-1","title":"twitter-bootstrap3 - security update","status":"published","published":"2025-04-13T00:00:00Z","modified":"2026-03-09T01:22:39.748823Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"ROOT-APP-NPM-CVE-2024-6485","title":"CVE-2024-6485 in @rootio/bootstrap - Patched by Root","description":"Root has patched CVE-2024-6485 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-16T06:13:18Z","modified":"2026-07-16T13:00:22.927795134Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"USN-7556-1","title":"twitter-bootstrap3, twitter-bootstrap4 vulnerabilities","description":"It was discovered that Bootstrap did not correctly sanitize certain input in\nthe carousel component. An attacker could possibly use this issue to execute a\ncross-site scripting (XSS) attack. (CVE-2024-6484, CVE-2024-6531)\n\nIt was discovered that Bootstrap did not correctly sanitize certain input in\nthe button plugin. An attacker could possibly use this issue to execute a\ncross-site scripting (XSS) attack. (CVE-2024-6485)","status":"published","published":"2025-06-05T04:47:40Z","modified":"2026-06-25T13:32:30.488430921Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}