Bootstrap: Schwachstelle ermöglicht Cross-Site Scripting

Summary

Product

Vulnerabilities 1

• Medium 5.6
  CVE-2025-1647

  XSS in Bootstrap title attribute for Tooltip and Popover

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.

  Bootstrap Bootstrap jupyter-base-notebook keycloak-26.5 Debian Ubuntu Wolfi npm
  May 15, 2025

Revision history

1. 2026-10-08 #4

   Neue Updates von Debian aufgenommen

2. 2025-09-16 #3

   Neue Updates von Amazon aufgenommen

3. 2025-06-01 #2

   Neue Updates von Debian aufgenommen

4. 2025-05-15 #1

   Initiale Fassung

References

• NIST Vulnerability Database vom 2025-05-15
  https://nvd.nist.gov/vuln/detail/CVE-2025-1647
• European Union Vulnerability Databse vom 2025-05-15
  https://euvd.enisa.europa.eu/enisa/EUVD-2025-15170
• PoC auf herodevs vom 2025-05-15
  https://www.herodevs.com/vulnerability-directory/cve-2025-1647
• Debian Security Advisory DLA-4204 vom 2025-06-01
  https://lists.debian.org/debian-lts-announce/2025/06/msg00001.html
• Amazon Linux Security Advisory ALAS2-2025-2995 vom 2025-09-16
  https://alas.aws.amazon.com/AL2/ALAS2-2025-2995.html
• Debian Security Advisory DLA-4830 vom 2026-10-09
  https://lists.debian.org/debian-lts-announce/2026/10/msg00023.html
• Debian Security Advisory DLA-1479 vom 2026-10-09
  https://security-tracker.debian.org/tracker/twitter-bootstrap3