Outdated Bootstrap Library Contains a Known Script Injection Flaw

Vulnerability Explanation

Bootstrap's collapse plugin reads the value of the data-parent HTML attribute and passes it directly to jQuery's $() selector function without sanitisation. If an attacker can control the value of this attribute — for example, by injecting HTML into a page that renders user-supplied content — they can supply a crafted string such as <img src=x onerror=alert(1)> which Bootstrap will evaluate as a DOM selector, causing the browser to execute the embedded script. The attack requires user interaction (a victim must trigger the collapse) and the attacker must be able to influence the data-parent attribute value, making this a DOM-based, reflected XSS vector rather than a stored one in most deployments.

Root Cause

The affected code directly assigns the raw value of the data-parent attribute to this.$parent via jQuery without input validation or sanitisation. jQuery's $() function accepts HTML strings as well as CSS selectors, so passing attacker-controlled HTML causes it to be parsed and inserted into the DOM, executing any embedded event handlers.

Technical Impact

An attacker who can control the data-parent attribute value can execute arbitrary JavaScript in the context of the victim's browser session. This enables session token theft, credential harvesting via fake UI overlays, redirection to malicious sites, or actions performed on behalf of the authenticated user.

Severity Justification

CVSS v3 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation requires user interaction and the ability to influence the data-parent attribute, limiting real-world exploitability in typical deployments where HTML attributes are server-rendered and not user-controlled. Impact is limited to confidentiality and integrity at a low level with no availability impact.

Affected Components

• Bootstrap >= 4.0.0 and < 4.1.2

Remediation Steps

1. Update Bootstrap to version 4.1.2 or later. This is the official patch release that sanitises the data-parent attribute before use.
2. If using npm: run `npm install bootstrap@latest` (or pin to `^4.6.2` for a v4 LTS-style release, or `^5.3.x` for the current major). Update your package.json accordingly.
3. If loading Bootstrap from a CDN, update the script and stylesheet URLs to reference 4.1.2 or later. Replace any hardcoded version strings in your HTML templates.
4. After updating, search your codebase for any remaining references to the old version (e.g., `bootstrap@4.0.0`, `bootstrap.min.js` with a 4.0.0 hash) to ensure no legacy copies are loaded.
5. If your application renders user-supplied data anywhere near Bootstrap collapse components, add server-side output encoding to ensure HTML attribute values are escaped before being written to the DOM.

Verification Steps

1. Run `npm list bootstrap` (or check your package-lock.json / yarn.lock) to confirm the installed version is 4.1.2 or later.
2. Load the page in a browser, open DevTools → Sources, and search for 'bootstrap' to confirm the loaded file version matches the updated release.
3. Use the Retire.js browser extension or run `npx retire --js` in your project directory to confirm no known-vulnerable Bootstrap versions are detected.
4. If using a CDN, inspect the network tab in DevTools and verify the Bootstrap URL contains the updated version number.

Best Practices

• Pin frontend library versions explicitly in package.json and use a lockfile (package-lock.json or yarn.lock) to prevent unintended version drift.
• Integrate a software composition analysis (SCA) tool such as Dependabot, Snyk, or `npm audit` into your CI pipeline to automatically flag vulnerable dependency versions.
• Always encode user-supplied data before writing it to HTML attributes — never trust client-side input to be safe for use as a jQuery selector or DOM attribute.
• Prefer loading Bootstrap from a versioned, integrity-checked CDN URL using Subresource Integrity (SRI) hashes to detect unexpected file tampering.