Earlier Bootstrap versions had XSS via data-bs-html and data-bs-template . In v5.1.3, the default sanitizer allows only safe tags/attributes, but if a developer disables sanitization ( sanitize: false ) and passes unsanitized user content, XSS becomes possible.