jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType o

Summary

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Timeline

1. Jan 18, 2018, 11:00 PM UTCCVE published
2. Aug 6, 2024, 8:43 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• jquerynpm

  fixed in 1.12.2

• jQueryNuGet

  fixed in 1.12.2

• jQueryNuGet

  From 1.12.3 · fixed in 3.0.0

• jquerynpm

  From 1.12.3 · fixed in 3.0.0

• jquery-railsRubyGems

  fixed in 4.2.0

• org.webjars.npm:jqueryMaven

  fixed in 1.12.2

• org.webjars.npm:jqueryMaven

  From 1.12.3 · fixed in 3.0.0

References 29