p PatchFirst

CVE-2025-1647

CVE-2025-1647 · XSS in Bootstrap title attribute for Tooltip and Popover

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.

CVSS 5.6 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • bootstrap

    Versions
    • ≥ 3.4.1, < 4.0.0: Affected (semver)

    Update to 4.0.0

  • twitter-bootstrap3 Debian:12

    Versions
    • 3.4.1+dfsg-3
    • 3.4.1+dfsg-3+deb12u1
    Affected ranges
    • ECOSYSTEM: < 3.4.1+dfsg-3+deb12u2

    Update to 3.4.1+dfsg-3+deb12u2

  • twitter-bootstrap3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.4.1+dfsg-5

    Update to 3.4.1+dfsg-5

  • twitter-bootstrap3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.4.1+dfsg-5

    Update to 3.4.1+dfsg-5

  • bootstrap npm

    Versions
    • 3.4.1

    No fix published

  • twitter-bootstrap3 Ubuntu:Pro:16.04:LTS

    Versions
    • 3.3.5+dfsg-1
    • 3.3.5+dfsg-2
    • 3.3.6+dfsg-1
    • 3.3.6+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twitter-bootstrap3 Ubuntu:Pro:18.04:LTS

    Versions
    • 3.3.7+dfsg-2
    • 3.3.7+dfsg-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twitter-bootstrap3 Ubuntu:Pro:20.04:LTS

    Versions
    • 3.4.1+dfsg-1
    • 3.4.1+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twitter-bootstrap3 Ubuntu:22.04:LTS

    Versions
    • 3.4.1+dfsg-2
    • 3.4.1+dfsg-2+deb11u2build0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twitter-bootstrap3 Ubuntu:24.04:LTS

    Versions
    • 3.4.1+dfsg-3
    • 3.4.1+dfsg-3+deb12u1build0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twitter-bootstrap3 Ubuntu:25.10

    Versions
    • 3.4.1+dfsg-3
    • 3.4.1+dfsg-4
    • 3.4.1+dfsg-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twitter-bootstrap3 Ubuntu:26.10

    Versions
    • 3.4.1+dfsg-6
    • 3.4.1+dfsg-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twitter-bootstrap3 Ubuntu:26.04:LTS

    Versions
    • 3.4.1+dfsg-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →