XSS possible in collapse data-parent attribute

[1Jesper1]

XSS possible in collapse data-parent attribute
data-parent="<img src=1 onerror=alert(123) />"
Bootstrap 4.1.1 in combination with JQuery 3.3.1

[Johann-S]

Bug reports must include a live demo of the problem. Per our contributing guidelines, please create a reduced test case via CodePen or JS Bin and report back with your link, Bootstrap version, and specific browser and OS details.

[1Jesper1]

https://jsbin.com/xeminoniku/edit?html,output

Browser: Chrome Version 66.0.3359.181 64x
OS: Windows 10 64x

[anarcat]

during some tests in the Debian LTS security team, it was determined that Bootstrap 2.0.2 is not affected by this issue.

[jenhae]

Hi @anarcat,

I don't know how the Debian LTS Team tested this issue, but I have an JSBin https://jsbin.com/xixaqeyofi/edit?html,output using bootstrap 2.3.0 which is affected by this CVE. I could track down the issue to line 34 of bootstrap-collapse using my example, see https://github.com/twbs/bootstrap/blob/v2.3.0/js/bootstrap-collapse.js#L34. This code behaves the same as https://github.com/twbs/bootstrap/blob/v2.0.0/js/bootstrap-collapse.js#L29.