twbs/bootstrap
The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.
View on Github
Activity
- Latest release
- Aug 26, 2025
- Total releases
- 79
- Cadence
- ~35 days
- Last 12 months
- 0
Reach
- Stars
- 174.5k
Details
- License
- MIT
- First release
- Dec 08, 2012
| Version | Released | |
|---|---|---|
v5.3.8
patch
| ||
v5.3.7
patch
| ||
v5.3.6
patch
| ||
v5.3.5
patch
| ||
v5.3.4
patch
| ||
v5.3.3
patch
| ||
v5.3.2
patch
| ||
v5.3.1
patch
| ||
v5.3.0
minor
| ||
v5.3.0-alpha3
pre
| ||
v5.3.0-alpha2
pre
| ||
v5.3.0-alpha1
pre
| ||
v5.2.3
patch
| ||
v5.2.2
patch
| ||
v5.2.1
patch
| ||
5.2.0
minor
| ||
v4.6.2
patch
| ||
v5.2.0-beta1
pre
| ||
v4.6.1
patch
| ||
v5.1.3
patch
| ||
v5.1.2
patch
| ||
v5.1.1
patch
| ||
v5.1.0
minor
| ||
v5.0.2
patch
| ||
v5.0.1
patch
| ||
v5.0.0
major
| ||
v5.0.0-beta3
pre
| ||
v5.0.0-beta2
pre
| ||
v4.6.0
minor
| ||
v5.0.0-beta1
pre
| ||
v5.0.0-alpha3
pre
| ||
v4.5.3
patch
| ||
v5.0.0-alpha2
pre
| ||
v4.5.2
patch
| ||
4.5.1
patch
| ||
v5.0.0-alpha1
pre
| ||
v4.5.0
minor
| ||
v4.4.1
patch
| ||
v4.4.0
minor
| ||
v4.3.1
patch
| ||
v3.4.1
patch
| ||
v4.3.0
minor
1 CVE
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev | ||
v4.2.1
patch
1 CVE
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev | ||
v4.2.0
minor
1 CVE
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev | ||
v3.4.0
minor
1 CVE
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev | ||
v4.1.3
patch
1 CVE
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev | ||
v4.1.2
patch
1 CVE
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev | ||
v4.1.1
patch
4 CVEs
CVE-2018-14040
GHSA-3wqf-4x89-9g79
May 13, 2022
Bootstrap vulnerable to Cross-Site Scripting (XSS)
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute. Affected versions
v2.3.0
v2.3.1
v2.3.2
v3.0.0
v3.0.0-rc.2
v3.0.0-rc1
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
+ 10 more Show less
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v4.0.0
v4.1.0
v4.1.1
Fixed in
3.4.0
4.1.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev
CVE-2018-14042
GHSA-7mvr-5x2g-wfc8
Sep 13, 2018
Bootstrap Cross-site Scripting vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041. Affected versions
v4.0.0
v4.1.0
v4.1.1
v2.3.0
v2.3.1
v2.3.2
v3.0.0
v3.0.0-rc.2
v3.0.0-rc1
v3.0.1
v3.0.2
v3.0.3
+ 10 more Show less
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
v3.3.6
v3.3.7
Fixed in
3.4.0
4.1.2
References
Updated Jun 08, 2026 · Source: OSV.dev
CVE-2018-14041
GHSA-pj7m-g53m-7638
Sep 13, 2018
Bootstrap Cross-site Scripting vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042. Affected versions
v4.0.0
v4.1.0
v4.1.1
Fixed in
4.1.2
References
Updated Nov 20, 2025 · Source: OSV.dev | ||
v4.1.0
minor
4 CVEs
CVE-2018-14040
GHSA-3wqf-4x89-9g79
May 13, 2022
Bootstrap vulnerable to Cross-Site Scripting (XSS)
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute. Affected versions
v2.3.0
v2.3.1
v2.3.2
v3.0.0
v3.0.0-rc.2
v3.0.0-rc1
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
+ 10 more Show less
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v4.0.0
v4.1.0
v4.1.1
Fixed in
3.4.0
4.1.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev
CVE-2018-14042
GHSA-7mvr-5x2g-wfc8
Sep 13, 2018
Bootstrap Cross-site Scripting vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041. Affected versions
v4.0.0
v4.1.0
v4.1.1
v2.3.0
v2.3.1
v2.3.2
v3.0.0
v3.0.0-rc.2
v3.0.0-rc1
v3.0.1
v3.0.2
v3.0.3
+ 10 more Show less
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
v3.3.6
v3.3.7
Fixed in
3.4.0
4.1.2
References
Updated Jun 08, 2026 · Source: OSV.dev
CVE-2018-14041
GHSA-pj7m-g53m-7638
Sep 13, 2018
Bootstrap Cross-site Scripting vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042. Affected versions
v4.0.0
v4.1.0
v4.1.1
Fixed in
4.1.2
References
Updated Nov 20, 2025 · Source: OSV.dev | ||
v4.0.0
major
4 CVEs
CVE-2018-14040
GHSA-3wqf-4x89-9g79
May 13, 2022
Bootstrap vulnerable to Cross-Site Scripting (XSS)
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute. Affected versions
v2.3.0
v2.3.1
v2.3.2
v3.0.0
v3.0.0-rc.2
v3.0.0-rc1
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
+ 10 more Show less
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v4.0.0
v4.1.0
v4.1.1
Fixed in
3.4.0
4.1.2
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2019-8331
GHSA-9v3m-8fp8-mj99
Feb 22, 2019
Bootstrap Vulnerable to Cross-Site Scripting
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
Versions of RecommendationFor Affected versions
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
+ 11 more Show less
v3.3.6
v3.3.7
v3.4.0
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.3.0
Fixed in
3.4.1
4.3.1
References
Updated Jun 02, 2026 · Source: OSV.dev
CVE-2018-14042
GHSA-7mvr-5x2g-wfc8
Sep 13, 2018
Bootstrap Cross-site Scripting vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar to CVE-2018-14041. Affected versions
v4.0.0
v4.1.0
v4.1.1
v2.3.0
v2.3.1
v2.3.2
v3.0.0
v3.0.0-rc.2
v3.0.0-rc1
v3.0.1
v3.0.2
v3.0.3
+ 10 more Show less
v3.1.0
v3.1.1
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.4
v3.3.5
v3.3.6
v3.3.7
Fixed in
3.4.0
4.1.2
References
Updated Jun 08, 2026 · Source: OSV.dev
CVE-2018-14041
GHSA-pj7m-g53m-7638
Sep 13, 2018
Bootstrap Cross-site Scripting vulnerability
6.1
/ 10
Medium
Network
Low
None
Required
Changed
Low
Low
None
In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042. Affected versions
v4.0.0
v4.1.0
v4.1.1
Fixed in
4.1.2
References
Updated Nov 20, 2025 · Source: OSV.dev |