VYPR
← All advisories
Moderate severityNVD Advisory· Published May 16, 2022· Updated Aug 3, 2024

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table

CVE-2022-1726

Description

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Bootstrap Tables before 1.20.2 has an XSS vulnerability via the Table Export plugin when exportOptions.htmlContent is true, allowing session cookie theft and data exfiltration.

Vulnerability

Bootstrap Tables prior to version 1.20.2 contains a cross-site scripting (XSS) vulnerability in the Table Export plugin. When the configuration option exportOptions.htmlContent is set to true, the plugin does not properly sanitize HTML content in exported tables, potentially leading to XSS attacks [1]. This affects all versions before the fix was released.

Exploitation

An attacker can inject malicious JavaScript into table cell content. When a user exports the table (e.g., to Excel) with htmlContent: true, the injected script executes in the context of the user's browser. The attacker needs the ability to insert data into the table (e.g., via stored XSS in a web application using Bootstrap Tables). The victim must trigger the export action.

Impact

Successful exploitation can lead to disclosure of session cookies, theft of secure session data, and exfiltration of sensitive information to third parties. The attacker can perform actions on behalf of the victim within the affected application.

Mitigation

The vulnerability is fixed in Bootstrap Tables version 1.20.2, as seen in commit b4a1e5d [3]. Users should upgrade to version 1.20.2 or later. As a workaround, set exportOptions.htmlContent to false or avoid using the export plugin with untrusted data. No CVE listing in KEV is available.

References
  1. NVD - CVE-2022-1726
  2. Fixed XSS vulnerability bug by onCellHtmlData · wenzhixin/bootstrap-table@b4a1e5d

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
bootstrap-tablenpm
< 1.20.21.20.2

Affected products

2

Patches

1
b4a1e5dd332b

Fixed XSS vulnerability bug by onCellHtmlData

https://github.com/wenzhixin/bootstrap-tablezhixinMay 10, 2022via ghsa
commit
1 file changed · +4 −16
  • src/extensions/export/bootstrap-table-export.js+4 −16 modified
    @@ -23,15 +23,7 @@ $.extend($.fn.bootstrapTable.defaults, {
   showExport: false,
   exportDataType: 'basic', // basic, all, selected
   exportTypes: ['json', 'xml', 'csv', 'txt', 'sql', 'excel'],
-  exportOptions: {
-    onCellHtmlData (cell, rowIndex, colIndex, htmlData) {
-      if (cell.is('th')) {
-        return cell.find('.th-inner').text()
-      }
-
-      return htmlData
-    }
-  },
+  exportOptions: {},
   exportFooter: false
 })
 
@@ -162,13 +154,9 @@ $.BootstrapTable = class extends $.BootstrapTable {
     $exportButtons.click(e => {
       e.preventDefault()
 
-      const type = $(e.currentTarget).data('type')
-      const exportOptions = {
-        type,
-        escape: false
-      }
-
-      this.exportTable(exportOptions)
+      this.exportTable({
+        type: $(e.currentTarget).data('type')
+      })
     })
     this.handleToolbar()
   }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.