Description
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.2.5-1.el8ev | RHSA-2021:1186 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.7-1.el8ev | RHSA-2021:1169 |
| Red Hat Rhev Manager 4 | rhvm +19 | 4.4.5.9-0.1.el8ev | RHSA-2021:1169 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | bootstrap-select | < 1.13.6 | 1.13.6 | GHSA-9r7h-6639-v5mw |
| NuGet | bootstrap-select | < 1.13.6 | 1.13.6 | GHSA-7c82-mp33-r854 |
Advisories 3
- RHSA-2021:1169 Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement Red Hat Security Advisories (RHSA) · Feb 24, 2026
- RHSA-2021:1186 Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance Red Hat Security Advisories (RHSA) · Jan 14, 2026
- WID-SEC-2022-0808 Red Hat Virtualization Engine: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2025