Bootstrap Cross-site Scripting vulnerability (CVE-2016-10735)

Why this deserves its current priority

CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps org.webjars:bootstrap (maven), org.webjars:bootstrap (maven), bootstrap (npm), bootstrap (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
org.webjars:bootstrapmaven	>=2.0.4 <3.4.0	3.4.0
org.webjars:bootstrapmaven	>=4.0.0-beta <4.0.0-beta.2	4.0.0-beta.2
bootstrapnpm	>=2.0.4 <3.4.0	3.4.0
bootstrapnpm	>=4.0.0-beta <4.0.0-beta.2	4.0.0-beta.2
bootstrap-sassnpm	>=2.0.4 <3.4.0	3.4.0
bootstrapnuget	>=2.0.4 <3.4.0	3.4.0
bootstrapnuget	>=4.0.0-beta <4.0.0-beta.2	4.0.0-beta.2
bootstrap.sassnuget	>=4.0.0-beta <4.0.0-beta.2	4.0.0-beta.2
twbs/bootstrappackagist	>=2.0.4 <3.4.0	3.4.0
twbs/bootstrappackagist	>=4.0.0-beta <4.0.0-beta.2	4.0.0-beta.2
bootstraprubygems	>=0 <4.0.0-beta.2	4.0.0-beta.2
bootstrap-sassrubygems	>=2.0.4 <3.4.0	3.4.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for org.webjars:bootstrap, org.webjars:bootstrap, bootstrap.
Review the reported fix. Update org.webjars:bootstrap to 3.4.0; org.webjars:bootstrap to 4.0.0-beta.2; bootstrap to 3.4.0; bootstrap to 4.0.0-beta.2; bootstrap-sass to 3.4.0; bootstrap to 3.4.0; bootstrap to 4.0.0-beta.2; bootstrap.sass to 4.0.0-beta.2; twbs/bootstrap to 3.4.0; twbs/bootstrap to 4.0.0-beta.2; bootstrap to 4.0.0-beta.2; bootstrap-sass to 3.4.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jan 17, 2019
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Aug 7, 2026

Sources and claim methodology

Upstream source description

In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041. See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.

Quoted source text, attributed separately from HOL analysis.