CVE-2021-23472

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
n/a	bootstrap-table	<1.19.1

References

https://github.com/wenzhixin/bootstrap-table/blob/develop/src/utils/index.js%23L218Broken Link, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1910690Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1910689Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBWENZHIXIN-1910687Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910688Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597Exploit, Mitigation, Third Party Advisory, VDB Entry
https://github.com/wenzhixin/bootstrap-table/blob/develop/src/utils/index.js%23L218Broken Link, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1910690Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1910689Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBWENZHIXIN-1910687Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910688Exploit, Mitigation, Third Party Advisory, VDB Entry
https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597Exploit, Mitigation, Third Party Advisory, VDB Entry

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23484.3Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Fra CVE-2021-234849.8The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction CVE-2021-23498.6Vulnerability in the Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Console). Supported versions that ar CVE-2021-234907.5The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.CVE-2021-234956.1The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.CVE-2021-234979.8This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execu CVE-2021-23507.5Vulnerability in the Hyperion Essbase Administration Services product of Oracle Essbase (component: EAS Console). Supported versions that ar CVE-2021-235079.8The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge obj CVE-2021-235099.8This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided CVE-2021-23518.3Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2 CVE-2021-235147.5This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.CVE-2021-235189.8The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Obje