<button data-bs-toggle="tooltip" data-bs-html="true" title="<img src=x onerror=alert(1)>">Hover me</button> If the developer improperly sanitized user input and allowed raw HTML in tooltips, an attacker could execute JavaScript. However, this is —it is a misconfiguration. Bootstrap requires explicit opt-in: you must set sanitize: false or misconfigure the allowList for this to work.
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; Avoid using 'unsafe-inline' for scripts if possible; use nonces or hashes instead. Never insert user-generated text directly into data-bs-content or title attributes without using textContent or a sanitization library like DOMPurify. bootstrap 5.1.3 exploit
<a data-bs-toggle="modal" data-bs-target="#maliciousModal" href="javascript:alert('XSS')">Click</a> This is not an exploit of the framework; it is a failure to sanitize URLs. Bootstrap does not automatically evaluate javascript: URIs—that behavior depends on the browser and other event handlers. Content-Security-Policy: default-src 'self'