CVE-2024-6485
XSS in Bootstrap button component
At a glance
- Severity
- MEDIUM 6.4
- EPSS
- EPSS 0.49 % · percentile 42 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- HeroDevs
- NVD status
- Deferred
Description
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L | HeroDevs |
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L | NVD · 36c7be3b-2937-45df-85ea-ca7133ea542c (Secondary) |
Weaknesses (CWE)
Advisories
- GHSA-vxmc-5x29-h64v — Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes
European references
- ENISA EUVD · EUVD-2024-2429
- GCVE · GCVE-0-2024-6485
CERT-FR advisories
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0901 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1078 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0896 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0760 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0279 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Bootstrap · Bootstrap | affected 1.4.0 ≤ 3.4.1 |
| Bootstrap-sass · bootstrap-sass | affected 2.3.2 ≤ 3.4.3 |
References
- https://www.herodevs.com/vulnerability-directory/cve-2024-6485
- https://lists.debian.org/debian-lts-announce/2025/04/msg00020.html
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |