CVE-2022-1726

What it actually does

Stored or reflected cross-site scripting via the Table Export plug-in when exportOptions.htmlContent is enabled, allowing arbitrary JavaScript execution in the context of the victim's browser session and potential theft of cookies or other client-side data.

Why it matters to the business

Organizations using the affected library risk unauthorized access to user sessions and exfiltration of sensitive data displayed in tables, increasing regulatory and reputational exposure until the component is updated.

How an attack unfolds

An attacker supplies or manipulates table data containing malicious HTML/JS payloads. When a user triggers an export with htmlContent enabled, the malicious content is rendered during the export process or subsequent display, executing the script in the user's browser and transmitting session tokens or other data to the attacker.

How to fix it

Upgrade wenzhixin/bootstrap-table to the version containing commit 9fe07b45dc9533f0d3b0173cfa37996b8e4a3c07 (corresponding to release 1.20.2 or later). Disable the htmlContent export option until the update can be applied. Review and sanitize any custom export templates or data sources that feed the tables.

How to confirm the fix worked

Confirm the installed bootstrap-table version is 1.20.2 or newer by inspecting package files or rendered script tags. Test the export function with sample data containing benign script markers to verify that scripts are no longer executed. Monitor application dependency manifests for the vulnerable commit hash.

Typical attack path

1. Identify an application embedding bootstrap-table with the export extension and htmlContent option set to true
2. Inject or supply crafted data containing executable script tags or event handlers into a table column
3. Trigger the export function (CSV, Excel, etc.) as a privileged or authenticated user
4. Script executes in the victim's browser context, exfiltrating cookies or performing actions on behalf of the user

How to detect it

Review web server and application logs for unusual export requests containing HTML tags or script patterns. Inspect browser console logs or network traffic for unexpected script execution originating from table export endpoints. Search source control history for prior usage of the htmlContent export option.

What your security team should do

• Immediately inventory all applications using bootstrap-table and schedule upgrade to the fixed commit within 30 days given public exploit availability
• Temporarily set exportOptions.htmlContent to false across all instances as a compensating control
• Add automated dependency scanning to block future vulnerable versions of bootstrap-table
• Educate developers on safe usage of HTML-export features and require code review for any table export configuration