Description
Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.
## Recommendation
Upgrade to version 2.0.0-rc.12 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | bootstrap-vue | < 2.0.0-rc.12 | 2.0.0-rc.12 | GHSA-c7pp-x73h-4m2v |
References
- https://github.com/bootstrap-vue/bootstrap-vue/issues/1974 web
- https://github.com/bootstrap-vue/bootstrap-vue/pull/2134 web
- https://github.com/bootstrap-vue/bootstrap-vue/commit/ba6f3f8359e257589d744f180312c09bf9f12289 web
- https://github.com/bootstrap-vue/bootstrap-vue package
- https://www.npmjs.com/advisories/770 web