SEC-044
Bootstrap JavaScript with known XSS flaws
LowDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Version numbers in script URLs, file names and library banner comments, against the bootstrap entries of the Retire.js vulnerability repository (fetched 2026-10-28). A bundle without a visible version is not judged.
Why it matters
Old Bootstrap JavaScript can execute script placed in tooltip, popover or collapse data attributes.
Recommended fix
Upgrade Bootstrap to 5.x, or at least 4.3.1 on v4. Bootstrap 3 no longer receives fixes (CVE-2024-6485 is unfixed in 3.x).
How to verify
Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-044: Bootstrap JavaScript with known XSS flaws
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Upgrade the Bootstrap JavaScript to a fixed release (5.x, or 4.3.1+ if staying on v4) and check that tooltips, popovers, collapses and modals still work.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).