VYPR
← All advisories
Moderate severityOSV Advisory· Published Jan 9, 2019· Updated Aug 6, 2024

CVE-2016-10735

CVE-2016-10735

Description

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Cross-site scripting (XSS) vulnerability in Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2 via the data-target attribute.

Vulnerability

Bootstrap versions 3.x prior to 3.4.0 and 4.x-beta prior to 4.0.0-beta.2 are vulnerable to cross-site scripting (XSS) due to improper sanitization of the data-target attribute in the tabs component [1]. An attacker can inject arbitrary HTML/JavaScript into this attribute, which is executed when the tab is activated [2].

Exploitation

An attacker needs to craft a malicious link or element with a data-target attribute containing JavaScript code (e.g., javascript:alert(1)). This can be delivered via a user clicking on a tab or navigating to a page with malicious content. No authentication is required if the attacker can inject content into a page using Bootstrap [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser, leading to potential information disclosure, session hijacking, or defacement. The attack does not require elevated privileges [1].

Mitigation

The fix was released in Bootstrap 3.4.0 and 4.0.0-beta.2 [2][3]. Users should upgrade to these versions or later. Red Hat also provided an update via RHBA-2019:1076 [1]. No workaround is available without patching.

References
  1. NVD - CVE-2016-10735
  2. Fix XSS in tabs by Johann-S · Pull Request #26460 · twbs/bootstrap
  3. GitHub - twbs/bootstrap: The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
bootstrapnpm
>= 2.0.4, < 3.4.03.4.0
bootstrapnpm
>= 4.0.0-beta, < 4.0.0-beta.24.0.0-beta.2
org.webjars:bootstrapMaven
>= 2.0.4, < 3.4.03.4.0
org.webjars:bootstrapMaven
>= 4.0.0-beta, < 4.0.0-beta.24.0.0-beta.2
bootstrapRubyGems
< 4.0.0-beta.24.0.0-beta.2
twbs/bootstrapPackagist
>= 2.0.4, < 3.4.03.4.0
twbs/bootstrapPackagist
>= 4.0.0-beta, < 4.0.0-beta.24.0.0-beta.2
bootstrapNuGet
>= 2.0.4, < 3.4.03.4.0
bootstrapNuGet
>= 4.0.0-beta, < 4.0.0-beta.24.0.0-beta.2
bootstrap-sassnpm
>= 2.0.4, < 3.4.03.4.0
bootstrap-sassRubyGems
>= 2.0.4, < 3.4.03.4.0
bootstrap.sassNuGet
>= 4.0.0-beta, < 4.0.0-beta.24.0.0-beta.2

Affected products

50

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

20

News mentions

0

No linked articles in our index yet.