Bootstrap: version with known vulnerabilities

best_practices.vulnerable_libraries.bootstrap

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, vulnerable libraries

What the rule checks

Scope. Applies to pages on which the library is detected: its window global (with its version field) or, for jQuery, Bootstrap, AngularJS, Lodash and Handlebars, a script URL whose path names the library and a version.

Expectation. Fails for every Bootstrap before 4.0.0 (end of life; every community release is covered by an advisory) and for 4.x below 4.3.1; 4.3.1 and later pass. Detected through `bootstrap.Tooltip.VERSION`, a `data-bs-version` attribute, or a script path naming the core build (bootstrap.min.js, bootstrap.bundle.min.js, bootstrap@4.1.3). A plugin named after Bootstrap (bootstrap-datepicker) is not Bootstrap. A page without the library: not applicable. A page that breaks the detection scripts (result missing or malformed) is not run for every library, never clean.

Source. retire.js jsrepository-v4.json (GitHub/NVD advisories), reviewed 2026-11-02 (tooltip XSS against GHSA-9v3m-8fp8-mj99); CVE-2019-8331 (3.x < 3.4.1, 4.x < 4.3.1), CVE-2018-14040/14042, CVE-2024-6485, CVE-2025-1647; Bootstrap 3 end of life

Detection: analyze_vulnerable_libraries; needs dom.

Failing example

The check reports a violation here. Corpus case vulnerable_libs_bootstrap_eol. The page may contain further findings for other rules.

vulnerable_libs_bootstrap_eol.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Bootstrap 2 next to current jQuery</title>
  <script>
    window.jQuery = { fn: { jquery: "3.7.1" } };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>Bootstrap 2 next to current jQuery</h1>
    <div data-bs-version="2.3.2"></div>
  </main>
</body>
</html>

Passing example

The check passes here and reports nothing. Corpus case vulnerable_libs_boundaries_first_safe. The page may contain further findings for other rules.

vulnerable_libs_boundaries_first_safe.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>First fixed releases</title>
  <script>
    window.jQuery = { fn: { jquery: "3.5.0" } };
    window.bootstrap = { Tooltip: { VERSION: "4.3.1" } };
    window.Handlebars = { VERSION: "4.7.10" };
    window._ = { VERSION: "4.18.0", runInContext: function () {} };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>First fixed releases</h1>

  </main>
</body>
</html>

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.