Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2020-11023GHSA-JPCQ-CGW6-V4J6BIT-DRUPAL-2020-11023

Potential XSS vulnerability in jQuery

Published
Last modified
published
Listed in CISA KEV
Fix
Fixed in 3.5.0, 4.4.0
None on Exploit-DB, Metasploit or GitHub

Summary

The jQuery JavaScript library, used to build and manipulate web page content, is affected. Passing HTML containing option elements from untrusted sources to its DOM manipulation methods, even after sanitizing it, can allow attackers to run malicious scripts in a user's browser.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • jquery jQuery

    From 1.0.3 · fixed in 3.5.0

  • jquerynpm

    From 1.0.3 · fixed in 3.5.0

  • jquery-railsRubyGems

    fixed in 4.4.0

  • jQueryNuGet

    From 1.0.3 · fixed in 3.5.0

  • org.webjars.npm:jqueryMaven

    From 1.0.3 · fixed in 3.5.0

  • components/jqueryPackagist

    From 1.0.3 · fixed in 3.5.0

References 25

debian.org

lists.fedoraproject.org

oracle.com

jquery.com

security.netapp.com

drupal.org

GitHub · jquery/jquery

blog.jquery.com

lists.opensuse.org

security.gentoo.org

lists.apache.org