NuGetPackage

jQuery

8 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release: 3.7.1 (Aug 30, 2023): no advisory affects it
Newest unaffected release: 3.7.1 (Aug 30, 2023), the latest release
Advisories: 8 · 2 medium

Releases: 67 since 1.4.1 (Feb 9, 2011)
Registry: NuGet
Releases read: Nov 8, 2026

Version timeline

CVE-2020-7656
Affects 1.4.1 to 1.8.3 (1.9.0 is outside it)
CVE-2020-11023
Affects 1.4.1 to 3.4.1 (3.5.0 is outside it)
CVE-2020-11022
Affects 1.12.0 to 3.4.1 (3.5.0 is outside it)
CVE-2019-11358
Affects 1.4.1 to 3.3.1 (3.4.0 is outside it)
CVE-2016-10707
No published release is affected
No published release is affected
CVE-2015-9251
Affects 1.4.1 to 1.12.1 (1.12.2 is outside it); 1.12.3 to 2.2.4 (3.0.0 is outside it)
CVE-2012-6708
Affects 1.4.1 to 1.8.3 (1.9.0 is outside it)
CVE-2011-4969
Affects 1.4.1 to 1.6.2 (1.6.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2020-7656Unrated
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.
Affected: from 1.2.1, fixed in 1.9.0.
Fixed in 1.9.0 (released Jan 15, 2013, 2681 days before disclosure).
The latest release, 3.7.1, is not affected.
CVE-2020-11023Medium 6.9 · KEV
Potential XSS vulnerability in jQuery
Affected: from 1.0.3, fixed in 3.5.0.
Fixed in 3.5.0 (released Apr 14, 2020, 15 days before disclosure).
The latest release, 3.7.1, is not affected.
CVE-2020-11022Medium 6.9
jQuery has a potential XSS vulnerability
Affected: from 1.12.0, fixed in 3.5.0.
Fixed in 3.5.0 (released Apr 14, 2020, 15 days before disclosure).
The latest release, 3.7.1, is not affected.
CVE-2019-11358Unrated
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of…
Affected: from 1.1.4, fixed in 3.4.0.
Fixed in 3.4.0 (released May 2, 2019, 13 days after disclosure).
The latest release, 3.7.1, is not affected.
CVE-2016-10707Unrated
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.
Affected: from 3.0.0-rc.1, fixed in 3.0.0.
Fixed in 3.0.0 (released Jun 16, 2016, 581 days before disclosure).
The latest release, 3.7.1, is not affected.
CVE-2015-9251Unrated
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType…
Affected: fixed in 1.12.2; from 1.12.3, fixed in 3.0.0.
Fixed in 1.12.2 (released Mar 29, 2016, 660 days before disclosure) and 3.0.0 (released Jun 16, 2016, 581 days before disclosure).
The latest release, 3.7.1, is not affected.
CVE-2012-6708Unrated
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.
Affected: fixed in 1.9.0.
Fixed in 1.9.0 (released Jan 15, 2013, 1829 days before disclosure).
The latest release, 3.7.1, is not affected.
CVE-2011-4969Unrated
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to…
Affected: fixed in 1.6.3.
Fixed in 1.6.3 (released Sep 8, 2011, 547 days before disclosure).
The latest release, 3.7.1, is not affected.