MavenPackage

org.webjars.npm:jquery

8 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release: 4.0.0 (Jan 18, 2026): no advisory affects it
Newest unaffected release: 4.0.0 (Jan 18, 2026), the latest release
Advisories: 8 · 2 medium

Dependents: 341
Releases: 48 since 1.7.2 (Jun 7, 2017)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2020-7656
Affects 1.7.2 to 1.8.3 (1.9.1 is outside it)
CVE-2020-11023
Affects 1.7.2 to 3.4.1 (3.5.0 is outside it)
CVE-2020-11022
Affects 1.12.1 to 3.4.1 (3.5.0 is outside it)
CVE-2019-11358
Affects 1.7.2 to 3.3.1 (3.4.0 is outside it)
CVE-2016-10707
Affects 3.0.0-rc1 (3.0.0 is outside it)
CVE-2015-9251
Affects 1.7.2 to 1.12.1 (1.12.2 is outside it); 1.12.3 to 3.0.0-rc1 (3.0.0 is outside it)
CVE-2012-6708
Affects 1.7.2 to 1.8.3 (1.9.1 is outside it)
CVE-2011-4969
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2020-7656Unrated
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.
Affected: from 1.2.1, fixed in 1.9.0.
Fixed in 1.9.1 (released Mar 26, 2018, 785 days before disclosure, the advisory names 1.9.0, which was never published).
The latest release, 4.0.0, is not affected.
CVE-2020-11023Medium 6.9 · KEV
Potential XSS vulnerability in jQuery
Affected: from 1.0.3, fixed in 3.5.0.
Fixed in 3.5.0 (released Apr 13, 2020, 16 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2020-11022Medium 6.9
jQuery has a potential XSS vulnerability
Affected: from 1.12.0, fixed in 3.5.0.
Fixed in 3.5.0 (released Apr 13, 2020, 16 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2019-11358Unrated
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of…
Affected: from 1.1.4, fixed in 3.4.0.
Fixed in 3.4.0 (released Apr 10, 2019, 9 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2016-10707Unrated
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.
Affected: from 3.0.0-rc1, fixed in 3.0.0.
Fixed in 3.0.0 (released Jun 9, 2016, 588 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2015-9251Unrated
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType…
Affected: fixed in 1.12.2; from 1.12.3, fixed in 3.0.0.
Fixed in 1.12.2 (released Mar 29, 2016, 660 days before disclosure) and 3.0.0 (released Jun 9, 2016, 588 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2012-6708Unrated
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.
Affected: fixed in 1.9.0.
Fixed in 1.9.1 (released Mar 26, 2018, 67 days after disclosure, the advisory names 1.9.0, which was never published).
The latest release, 4.0.0, is not affected.
CVE-2011-4969Unrated
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to…
Affected: fixed in 1.6.3.
Fixed in 1.7.2 (released Jun 7, 2017, 1552 days after disclosure, the advisory names 1.6.3, which was never published).
The latest release, 4.0.0, is not affected.