Bootbox is used to show modals and alerts. You can test it by running bootbox.alert('hello') in your browser console.
The vulnerability mentioned comes from bootbox allowing any html to be passed in. For example bootbox.alert('hello<script>alert("ok")</script>') This will execute the javascript in the text. So it has to be sanitized before passing it to bootbox. bootbox.alert(utils.escapeHTML('hello<script>alert("ok")</script>'))
For the full discussion you can check https://github.com/makeusabrew/bootbox/issues/661