CVE-2019-20921

Name of the Vulnerable Software and Affected Versions bootstrap-select versions prior to 1.13.6

Description The issue allows Cross-Site Scripting (XSS) due to the failure to escape title values in OPTION elements. This may enable attackers to execute arbitrary JavaScript in a victim's browser.

Recommendations For versions prior to 1.13.6, update to version 1.13.6 or later to resolve the issue. As a temporary workaround, consider disabling the use of title values in OPTION elements until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.