{"items":[{"id":"NVI-00006667","kind":"vulnerability","title":"Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"withdrawn","identifiers":["GHSA-vc8w-jr9v-vj7f","CVE-2024-6531"],"plain_summary":"OSV carries this publisher advisory for bootstrap, bootstrap, bootstrap, bootstrap.sass, twbs/bootstrap. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.0.0 for bootstrap. Confirm the publisher’s latest guidance.","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.0.0 for twbs/bootstrap. Confirm the publisher’s latest guidance.","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a4be66a4569baa8f3f31063b2225c729"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-bde7bd3dfb2e106a53267679e19dab30","url":"https://github.com/advisories/GHSA-vc8w-jr9v-vj7f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-vc8w-jr9v-vj7f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:41.373Z"},{"id":"sr-a4be66a4569baa8f3f31063b2225c729","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6531","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2024-6531","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T00:59:51.327Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["SEMVER: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"bootstrap.sass","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"twbs/bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"org.webjars:bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"org.webjars.npm:bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]}],"null_published_at":"2026-11-06T15:18:17.655Z","source_updated_at":"2026-09-10T03:50:17.438Z","source_disclosed_at":"2024-07-11T18:31:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:41.373Z"},{"id":"NVI-00006667","kind":"vulnerability","title":"Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"withdrawn","identifiers":["GHSA-vc8w-jr9v-vj7f","CVE-2024-6531"],"plain_summary":"OSV carries this publisher advisory for bootstrap, bootstrap, bootstrap, bootstrap.sass, twbs/bootstrap. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.0.0 for bootstrap. Confirm the publisher’s latest guidance.","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.0.0 for twbs/bootstrap. Confirm the publisher’s latest guidance.","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-bde7bd3dfb2e106a53267679e19dab30","url":"https://github.com/advisories/GHSA-vc8w-jr9v-vj7f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-vc8w-jr9v-vj7f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:41.373Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["SEMVER: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"bootstrap.sass","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"twbs/bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"org.webjars:bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]},{"certainty":"source_listed","source_ids":["sr-bde7bd3dfb2e106a53267679e19dab30"],"technology":"org.webjars.npm:bootstrap","known_exclusions":[],"conditions_summary":"## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an  tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0; fixed 5.0.0"]}],"null_published_at":"2026-10-31T22:13:10.068Z","source_updated_at":"2026-09-10T03:50:17.438Z","source_disclosed_at":"2024-07-11T18:31:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:41.373Z"}],"next_cursor":null,"snapshot_revision":"42594"}