# jQuery (NuGet) vulnerabilities

8 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 3.7.1 (Aug 30, 2023): no advisory affects it
- Newest unaffected release: 3.7.1 (Aug 30, 2023), the latest release
- Releases: 67 since 1.4.1 (Feb 9, 2011)
- Registry: https://www.nuget.org/packages/jQuery
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2020-7656: 1.4.1 to 1.8.3 (1.9.0 is outside it)
- CVE-2020-11023: 1.4.1 to 3.4.1 (3.5.0 is outside it)
- CVE-2020-11022: 1.12.0 to 3.4.1 (3.5.0 is outside it)
- CVE-2019-11358: 1.4.1 to 3.3.1 (3.4.0 is outside it)
- CVE-2016-10707: no published release is affected
- CVE-2015-9251: 1.4.1 to 1.12.1 (1.12.2 is outside it); 1.12.3 to 2.2.4 (3.0.0 is outside it)
- CVE-2012-6708: 1.4.1 to 1.8.3 (1.9.0 is outside it)
- CVE-2011-4969: 1.4.1 to 1.6.2 (1.6.3 is outside it)

## Advisories (8)

### [CVE-2020-7656](https://cve.now/CVE-2020-7656): jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.

- Severity: Unrated
- Published: May 19, 2020
- Affected: from 1.2.1, fixed in 1.9.0.
- Fixed in 1.9.0 (released Jan 15, 2013, 2681 days before disclosure).
- The latest release, 3.7.1, is not affected.

### [CVE-2020-11023](https://cve.now/CVE-2020-11023): Potential XSS vulnerability in jQuery

- Severity: Medium 6.9 · KEV
- Published: Apr 29, 2020
- Affected: from 1.0.3, fixed in 3.5.0.
- Fixed in 3.5.0 (released Apr 14, 2020, 15 days before disclosure).
- The latest release, 3.7.1, is not affected.

### [CVE-2020-11022](https://cve.now/CVE-2020-11022): jQuery has a potential XSS vulnerability

- Severity: Medium 6.9
- Published: Apr 29, 2020
- Affected: from 1.12.0, fixed in 3.5.0.
- Fixed in 3.5.0 (released Apr 14, 2020, 15 days before disclosure).
- The latest release, 3.7.1, is not affected.

### [CVE-2019-11358](https://cve.now/CVE-2019-11358): jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of…

- Severity: Unrated
- Published: Apr 19, 2019
- Affected: from 1.1.4, fixed in 3.4.0.
- Fixed in 3.4.0 (released May 2, 2019, 13 days after disclosure).
- The latest release, 3.7.1, is not affected.

### [CVE-2016-10707](https://cve.now/CVE-2016-10707): jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.

- Severity: Unrated
- Published: Jan 18, 2018
- Affected: from 3.0.0-rc.1, fixed in 3.0.0.
- Fixed in 3.0.0 (released Jun 16, 2016, 581 days before disclosure).
- The latest release, 3.7.1, is not affected.

### [CVE-2015-9251](https://cve.now/CVE-2015-9251): jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType…

- Severity: Unrated
- Published: Jan 18, 2018
- Affected: fixed in 1.12.2; from 1.12.3, fixed in 3.0.0.
- Fixed in 1.12.2 (released Mar 29, 2016, 660 days before disclosure) and 3.0.0 (released Jun 16, 2016, 581 days before disclosure).
- The latest release, 3.7.1, is not affected.

### [CVE-2012-6708](https://cve.now/CVE-2012-6708): jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.

- Severity: Unrated
- Published: Jan 18, 2018
- Affected: fixed in 1.9.0.
- Fixed in 1.9.0 (released Jan 15, 2013, 1829 days before disclosure).
- The latest release, 3.7.1, is not affected.

### [CVE-2011-4969](https://cve.now/CVE-2011-4969): Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to…

- Severity: Unrated
- Published: Mar 8, 2013
- Affected: fixed in 1.6.3.
- Fixed in 1.6.3 (released Sep 8, 2011, 547 days before disclosure).
- The latest release, 3.7.1, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/nuget/jquery
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.