CVE-2018-14040

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

CVSS v3.0 NVD

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.13% chance of exploitation in the next 30 days, 91st percentile

Published

2018-07-13

Updated

2024-08-05

Proof-of-concept exploits (3)

• Snorlyd/https-nj.gov---CVE-2018-140401★ · 2022-05-23
• Yumeae/Bootstrap-with-XSS4★ · 2025-08-21
• ossf-cve-benchmark/CVE-2018-140400★ · 2020-12-01

Security advisories

• https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2
• twbs/bootstrap/issues/26625
• https://lists.debian.org/debian-lts-announce/2018/08/msg00027.html
• advisories/GHSA-3wqf-4x89-9g79
• https://www.oracle.com/security-alerts/cpuApr2021.html

References

• CVE Record
• NVD entry

Related

• CVE-2018-14041
• CVE-2018-14042
• CVE-2019-11358
• CVE-2019-8331
• CVE-2020-11022
• CVE-2020-11023