npm/bootstrap CVE-2016-10735: medium 6.1, EPSS 4.04%

Bootstrap Cross-site Scripting vulnerability

Action: Upgrade bootstrap to 3.4.0 (3.x) or 4.0.0-beta.2 (4.x) or later.

npm i bootstrap@3.4.0

npm i bootstrap@4.0.0-beta.2

Affected

Fixed versions

Sources

• osv: GHSA-4p24-vmcr-4gqj
• https://nvd.nist.gov/vuln/detail/CVE-2016-10735
• https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906
• https://github.com/twbs/bootstrap/issues/20184
• https://github.com/twbs/bootstrap/pull/26460
• https://github.com/twbs/bootstrap/pull/23687
• https://github.com/twbs/bootstrap/pull/23679
• https://github.com/github/advisory-database/pull/3281
• https://github.com/twbs/bootstrap
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2016-10735.yml
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2016-10735.yml
• https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0
• https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2
• https://access.redhat.com/errata/RHSA-2020:0133
• https://access.redhat.com/errata/RHSA-2020:0132
• https://access.redhat.com/errata/RHSA-2019:3023
• https://access.redhat.com/errata/RHSA-2019:1456
• https://access.redhat.com/errata/RHBA-2019:1570
• https://access.redhat.com/errata/RHBA-2019:1076

CVE-2016-10735 · published 2019-01-17T13:57:27Z · modified 2026-09-10T03:47:46.216378687Z · JSON