In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-44094.json"