jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp

Summary

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Timeline

1. Apr 19, 2019, 12:00 AM UTCCVE published
2. Feb 20, 2024, 3:03 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Nov 15, 2024, 3:11 PM UTCRecord last updated
4. Apr 8, 2025Public exploit on Exploit-DB

   EDB-52141

5. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• jquerynpm

  From 1.1.4 · fixed in 3.4.0

• jquery-railsRubyGems

  fixed in 4.3.4

• jQueryNuGet

  From 1.1.4 · fixed in 3.4.0

• djangoPyPI

  From 2.0a1 · fixed in 2.1.9

• djangoPyPI

  From 2.2a1 · fixed in 2.2.2

• org.webjars.npm:jqueryMaven

  From 1.1.4 · fixed in 3.4.0

• maximebf/debugbarPackagist

  fixed in 1.19.0

• djangoPyPI

  From 2.0a1 · fixed in 2.1.9; From 2.2a1 · fixed in 2.2.2

• drupal/corePackagist

  From 8.0.0 · fixed in 8.5.15; From 8.6.0 · fixed in 8.6.15

References 32