Versions of bootstrap-vue prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the options variable. This may lead to the execution of malicious JavaScript on the user's browser.

Recommendation

Upgrade to version 2.0.0-rc.12 or later.

References

• https://www.npmjs.com/advisories/770
• bootstrap-vue/bootstrap-vue#1974
• bootstrap-vue/bootstrap-vue#2134
• bootstrap-vue/bootstrap-vue@ba6f3f8