Skip to content
OpenAdvisories
Medium · 6.4 Public exploit CVE-2024-6485 EUVD-2024-2429GHSA-vxmc-5x29-h64v

XSS in Bootstrap button component

Published Jul 11, 2024 · Updated Nov 3, 2025 · Assigned by HeroDevs

Vendor: Bootstrap Vendor: Bootstrap-sass Product: Bootstrap Product: bootstrap-sass Package: bootstrap Package: ceph Package: fluent-bit Package: jupyter-base-notebook Package: keycloak-26.5 Package: keycloak-26.5-iamguarded-compat Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Package: ntopng Package: python-openstackdocstheme Package: pytorch Package: reaper Package: twitter-bootstrap3 Package: twitter-bootstrap3 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

Affected products

VendorProductAffectedFixed
Bootstrap Bootstrap 1.4.0 – ≤ 3.4.1 —
Bootstrap-sass bootstrap-sass 2.3.2 – ≤ 3.4.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 twitter-bootstrap3 3.4.1+dfsg-4 —
Debian 13 twitter-bootstrap3 3.4.1+dfsg-4 —
Debian 12 twitter-bootstrap3 3.4.1+dfsg-3+deb12u1 —
Debian 11 twitter-bootstrap3 3.4.1+dfsg-2+deb11u1 DLA-4124-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS twitter-bootstrap3 3.4.1+dfsg-3+deb12u1build0.24.04.1 USN-7556-1
Ubuntu 24.04 LTS twitter-bootstrap4 4.6.1+dfsg1-4+deb12u1build0.24.04.1 USN-7556-1
Ubuntu 22.04 LTS twitter-bootstrap3 3.4.1+dfsg-2+deb11u2build0.22.04.1 USN-7556-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS twitter-bootstrap4 4.6.0+dfsg1-4ubuntu0.1~esm1 USN-7556-1
Ubuntu Pro 20.04 LTS twitter-bootstrap3 3.4.1+dfsg-1ubuntu0.1~esm1 USN-7556-1
Ubuntu Pro 20.04 LTS twitter-bootstrap4 4.4.1+dfsg1-2ubuntu0.1~esm1 USN-7556-1
Ubuntu Pro 18.04 LTS twitter-bootstrap3 3.3.7+dfsg-2ubuntu0.1~esm1 USN-7556-1
Ubuntu Pro 16.04 LTS twitter-bootstrap3 3.3.6+dfsg-1ubuntu0.1~esm1 USN-7556-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 ceph +4 No fix yet —
Azure Linux 2 (CBL-Mariner) reaper 3.1.1-22 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling keycloak-26.5 +4 No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Yumeae/Bootstrap-with-XSS ★ 4 · Jul 21, 2025

    A poc for Bootstrap XSS(CVE-2024-6485、CVE-2016-10735、CVE-2019-8331、CVE-2018-14040)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm bootstrap >= 1.4.0, <= 3.4.1 — GHSA-vxmc-5x29-h64v

Advisories 3

References