tooltip - XSS on data-viewport attribute

Created by: don-spyker

found in bootstrap 3.3.7

<a href="#" data-toggle="tooltip" data-viewport="<img src=1 onerror=alert(123) />" title="Hooray!">Hover over me</a> https://jsbin.com/qipirurise/edit?html,output

Win 7 x64 Chrome 67.0.3396.99 Firefox 61.0.1 (64-Bit)