In Bootstrap before 4.1.2, XSS is possible in collapse data-parent attribute (CVE-2018-14040), data-target property of scrollspy (CVE-2018-14041), data-container property of tooltip (CVE-2018-14042)
blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/