---
title: Bootstrap – XSS Vulnerability On Versions Under 2.1.0, On popover / tooltip
description: "**Impact area** Security **Severity** High **Affected element** **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-BOOTSTRAP-LESSTHAN-V210** (for ServiceNow) **SF-JSL-BOOTSTRAP-LESSTHAN-V210** (for Salesforce) ## Impact Under some circumstances, it is possible to include an XSS attack on text passed to the bootstrap popover/tooltip…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/bootstrap-xss-vulnerability-on-versions-under-2-1-0-on-popover-tooltip/"
updated: "2025-03-21"
category: Rules
---

# Bootstrap – XSS Vulnerability On Versions Under 2.1.0, On popover / tooltip

**Impact area**

Security

**Severity**

High

**Affected element**

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-BOOTSTRAP-LESSTHAN-V210** (for ServiceNow)

**SF-JSL-BOOTSTRAP-LESSTHAN-V210** (for Salesforce)

## Impact

Under some circumstances, it is possible to include an XSS attack on text passed to the bootstrap popover/tooltip function in versions before 2.1.0.

## Remediation

Update bootstrap to the latest version.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html).