{"action":"Upgrade bootstrap-select to 1.13.6 or later.","affected":[{"fixed":"1.13.6","introduced":"0"}],"component":"bootstrap-select","cve_ids":["CVE-2019-20921"],"ecosystem":"npm","epss":0.01738,"exploited":false,"fixed_versions":["1.13.6"],"ghsa_id":"GHSA-7c82-mp33-r854","id":"tcs_01M5KF9KNFEN3AKARZ4DM9JMEV","modified_at":"2026-09-10T03:49:04.898433728Z","published_at":"2021-05-07T16:47:54Z","references":["https://osv.dev/vulnerability/GHSA-7c82-mp33-r854","https://nvd.nist.gov/vuln/detail/CVE-2019-20921","https://github.com/snapappointments/bootstrap-select/issues/2199","https://github.com/snapappointments/bootstrap-select/commit/ab6e068748040cf3cda5859f6349b382402b8767","https://github.com/snapappointments/bootstrap-select","https://issues.jtl-software.de/issues/SHOP-7964","https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-7c82-mp33-r854","url":"https://osv.dev/vulnerability/GHSA-7c82-mp33-r854"}],"summary":"Cross-site scripting in bootstrap-select"}