{"id":"GHSA-q58r-hwc8-rm9j","revision":"c40b7309a2124f5d9604ebaac573443b","records":[{"revision":"c40b7309a2124f5d9604ebaac573443b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-q58r-hwc8-rm9j","aliases":["CVE-2025-1647"],"title":"Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1. At time of publication, there is no publicly available patched version.","state":0,"publishedAt":"2025-05-15T18:31:47+00:00","modifiedAt":"2026-10-09T12:45:03.6907758+00:00","affected":[{"ecosystem":"npm","name":"bootstrap","ranges":[],"versions":["3.4.1"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-1647","https://github.com/twbs/bootstrap","https://lists.debian.org/debian-lts-announce/2025/06/msg00001.html","https://lists.debian.org/debian-lts-announce/2026/10/msg00023.html","https://www.herodevs.com/vulnerability-directory/cve-2025-1647"],"sourceUrl":"https://github.com/advisories/GHSA-q58r-hwc8-rm9j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q58r-hwc8-rm9j","identifiers":["GHSA-q58r-hwc8-rm9j","CVE-2025-1647"]},"retained":false,"historicalAffected":[]}],"coverage":[]}