CVE-2025-1647

What it actually does

Improper neutralization of input during HTML generation in Bootstrap 3.4.1 before 4.0.0 allows cross-site scripting: untrusted data can be interpolated into rendered pages without adequate encoding, so attacker-controlled script or markup may execute in the hosting application's browser origin. The issue is network-reachable without privileges and is scored without required user interaction, but high attack complexity means specific component usage, encoding context, and rendering conditions must align. Confidentiality, integrity, and availability impacts are each limited (session/token exposure, UI tampering, and localized disruption rather than full host compromise).

Why it matters to the business

Abuse can hijack or impersonate web users, alter trusted page content, or support phishing from a legitimate origin, harming customer trust and enabling unauthorized actions in the application. Urgency is moderate-to-low: CVSS is 5.6, EPSS is about 0.00316 and flat over 30 days, exploit maturity is none, the CVE is not in CISA KEV, and it is not associated with ransomware. Residual operational risk remains wherever Bootstrap 3.x is still served or where Ubuntu Pro 22.04/24.04 LTS Subversion packages have not received the listed ESM updates, especially on internet-facing web UIs.

How an attack unfolds

An unauthenticated remote attacker finds an application that still uses vulnerable Bootstrap 3.x and that reflects or stores attacker-influenced data into generated markup. Under high-complexity conditions, the attacker supplies input that Bootstrap does not neutralize, so the generated page includes script that runs in the application's origin when a victim's browser loads it. That script can read data the user can access, modify the page, or issue requests as the user. No named threat actors or campaigns are reported, and there is no public exploit maturity after more than a year since publication.

How to fix it

Upgrade Bootstrap to 4.0.0 or later (leave the 3.4.1–<4.0.0 range). On Ubuntu Pro 22.04 LTS, upgrade the subversion package to 1.14.1-3ubuntu0.22.04.1+esm1. On Ubuntu Pro 24.04 LTS, upgrade the subversion package to 1.14.3-1ubuntu0.1~esm1. Apply ESM updates via the Ubuntu Pro channel rather than unpatched archive packages. Complement patching with output encoding at render time, a strict Content-Security-Policy (disallow unsafe-inline where feasible), HttpOnly/Secure/SameSite cookies, and removal of unused Bootstrap 3 plugins that accept raw HTML.

How to confirm the fix worked

Inventory front-end assets and lockfiles for bootstrap 3.4.1 through any 3.x below 4.0.0; confirm production script tags and CDNs no longer serve that range. On Ubuntu Pro hosts, verify dpkg/apt shows subversion 1.14.1-3ubuntu0.22.04.1+esm1 (22.04) or 1.14.3-1ubuntu0.1~esm1 (24.04). Re-test previously unsafe render paths (tooltips, popovers, templates, dynamic HTML helpers) and confirm user-controlled strings are encoded. Use CSP report-only then enforcing mode and browser devtools to ensure no residual inline script from interpolated input.

Typical attack path

1. Map public or authenticated pages that load Bootstrap 3.x (3.4.1 through last 3.x) and that interpolate untrusted data into HTML.
2. Submit crafted input into parameters, stored fields, or component options that flow into the insufficiently neutralized rendering path.
3. Cause the application to generate a page that includes the injected script or markup in the application origin.
4. When a victim browser renders that page, the script runs and can steal session material, alter the UI, or perform actions as the user.
5. Optionally persist or chain the foothold (further stored XSS, credential replay) if the application retains the malicious content.

How to detect it

This is client-side XSS, so evidence of prior abuse is in web access/error logs, WAF/RASP events, reverse-proxy logs, CSP violation reports, and browser/EDR telemetry—not typical host malware artifacts. Search for requests to pages that served Bootstrap 3.x where query strings, POST bodies, or stored fields contained HTML/JS metacharacters that later appeared in responses. Review CSP reports for blocked inline script or unexpected script-src on those pages, session-cookie theft follow-on (anomalous reuse of session IDs from new IPs/UAs), and sudden DOM/content changes. Compare deploy dates of Bootstrap 3 assets versus first suspicious input. No named actors or ransomware TTPs are tied to this CVE, so hunt on generic XSS and session-abuse patterns rather than actor-specific tooling.

• bootstrap.js
• bootstrap.min.js
• bootstrap 3.4.1
• /dist/js/bootstrap.js
• /dist/js/bootstrap.min.js
• node_modules/bootstrap/dist/js/bootstrap.js
• %3Cscript
• <script
• javascript:
• onerror=
• onload=
• document.cookie
• blocked-uri":"inline
• script-src 'unsafe-inline'

What your security team should do

• Inventory Bootstrap 3.x (including bundled, vendored, and CDN copies) and Ubuntu Pro 22.04/24.04 Subversion packages; treat internet-facing UIs as first-wave.
• Apply the exact ESM package upgrades and move Bootstrap to 4.0.0 or later; do not rely on WAF-only mitigation.
• Enforce CSP, cookie flags, and server-side output encoding as compensating controls until every 3.x asset is gone.
• Hunt historical web, WAF, and CSP logs for XSS-style input against pages that loaded Bootstrap 3, even though EPSS is low and no KEV/ransomware use is known.
• Add SCA/lockfile and OS-package checks so Bootstrap <4.0.0 and unfixed Ubuntu Subversion builds cannot re-enter CI or production images.