{"id":"GHSA-c7pp-x73h-4m2v","aliases":["CLSA-2026-1774743845"],"status":"published","title":"Cross-Site Scripting in bootstrap-vue","description":"Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.0-rc.12 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-09-02T15:53:46Z","modified":"2026-10-15T09:47:48Z","fixes":[{"ecosystem":"npm","package":"bootstrap-vue","fixed_in":["2.0.0-rc.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"bootstrap-vue","fixed_in":["1.5.1-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"bootstrap-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.0-rc.11"},{"fixed":"2.0.0-rc.12"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"bootstrap-vue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"]},{"source":"osv","ecosystem":"npm","package":"bootstrap-vue","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0-rc.12"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/770","tags":["web"]},{"url":"https://github.com/bootstrap-vue/bootstrap-vue/issues/1974","tags":["web"]},{"url":"https://github.com/bootstrap-vue/bootstrap-vue/pull/2134","tags":["web"]},{"url":"https://github.com/bootstrap-vue/bootstrap-vue/commit/ba6f3f8359e257589d744f180312c09bf9f12289","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c7pp-x73h-4m2v"},{"url":"https://github.com/bootstrap-vue/bootstrap-vue","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-c7pp-x73h-4m2v","title":"Cross-Site Scripting in bootstrap-vue","description":"Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.0-rc.12 or later.","status":"published","published":"2020-09-02T15:53:46Z","modified":"2023-04-03T21:53:50Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"osv":[{"id":"CLSA-2026-1774743845","title":"TuxCare security update for bootstrap-vue (1 CVE)","description":"TuxCare rebuilt bootstrap-vue to address 1 CVE. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.458756117Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"GHSA-c7pp-x73h-4m2v","title":"Cross-Site Scripting in bootstrap-vue","description":"Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.0-rc.12 or later.","status":"published","published":"2020-09-02T15:53:46Z","modified":"2021-09-27T15:43:19Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}