// Vulnerable example in alpha.6 // An attacker could inject: data-trigger="click" data-html="true" data-content="<img src=x onerror=alert(1)>" $('#element').tooltip(); Severity: Low to Medium Affected components: Tooltip, Popover
Published: April 17, 2026
The tooltip and popover plugins in Bootstrap versions prior to 3.4.1 and 4.3.x before 4.3.1 contained an XSS vulnerability. While alpha.6 predates these fixes, the vulnerable code pattern exists in this alpha release. Attackers could inject malicious JavaScript through custom data-* attributes when the tooltip or popover was initialized with unsanitized user input. bootstrap v4.0.0-alpha.6 vulnerabilities
