[GHSA-pj7m-g53m-7638] Bootstrap Cross-site Scripting vulnerability

[jenhae]

Updates

• Affected products
• Description

Comments
I used the example of twbs/bootstrap#26627 (comment) and modified the bootstrap version to one below the formerly stated patched version 3.4.0 and couldn't verify the issue see https://jsbin.com/jafujoqage/edit?html,output

[shelbyc]

Hi @jenhae, my colleague @JonathanLEvans and I worked together and found the commit that introduced the vulnerable code in version 4.0.0-alpha6. twbs/bootstrap@c2616fb#diff-1d84c75bd9722a89a7db565ca8061c7b2c7657ed908a9cb2a2feb1124537429b shows where const targets = $.makeArray($(this._selector)), the line that was fixed in https://github.com/twbs/bootstrap/pull/26630/files#diff-1d84c75bd9722a89a7db565ca8061c7b2c7657ed908a9cb2a2feb1124537429b. Even searching for let targets = $.makeArray($(this._selector)) led me to this commit where the line was added in scrollspy.js in the 4.x branch, and I was unable to find let targets = $.makeArray($(this._selector)) in any 3.x versions. Because your findings are consistent with evidence in the source code, we are accepting this contribution.

[advisory-database]

Hi @jenhae! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!