{"action":"No fix published. Pin and monitor.","affected":[],"component":"bootstrap","cve_ids":["CVE-2025-1647"],"ecosystem":"npm","epss":0.00432,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-q58r-hwc8-rm9j","id":"tcs_01M5KG57K2EE0AGB13X11CA7CD","modified_at":"2026-10-09T12:45:03.690775762Z","published_at":"2025-05-15T18:31:47Z","references":["https://osv.dev/vulnerability/GHSA-q58r-hwc8-rm9j","https://nvd.nist.gov/vuln/detail/CVE-2025-1647","https://github.com/twbs/bootstrap","https://lists.debian.org/debian-lts-announce/2025/06/msg00001.html","https://lists.debian.org/debian-lts-announce/2026/10/msg00023.html","https://www.herodevs.com/vulnerability-directory/cve-2025-1647"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-q58r-hwc8-rm9j","url":"https://osv.dev/vulnerability/GHSA-q58r-hwc8-rm9j"}],"summary":"Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components"}