{
"id": "GHSA-c7pp-x73h-4m2v",
"aliases": [],
"details": "Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.0-rc.12 or later.",
"summary": "Cross-Site Scripting in bootstrap-vue",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-rc.12"
}
]
}
],
"package": {
"name": "bootstrap-vue",
"ecosystem": "npm"
},
"database_specific": {
"last_known_affected_version_range": "<= 2.0.0-rc.11"
}
}
],
"modified": "2021-09-27T15:43:19Z",
"severity": [],
"published": "2020-09-02T15:53:46Z",
"references": [
{
"url": "https://github.com/bootstrap-vue/bootstrap-vue/issues/1974",
"type": "WEB"
},
{
"url": "https://github.com/bootstrap-vue/bootstrap-vue/pull/2134",
"type": "WEB"
},
{
"url": "https://github.com/bootstrap-vue/bootstrap-vue/commit/ba6f3f8359e257589d744f180312c09bf9f12289",
"type": "WEB"
},
{
"url": "https://github.com/bootstrap-vue/bootstrap-vue",
"type": "PACKAGE"
},
{
"url": "https://www.npmjs.com/advisories/770",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-08-31T18:35:07Z"
}
}