PT-2020-4421 · Jquery+12 · Jquery+12
Published
2020-04-29
·
Updated
2026-03-10
·
CVE-2020-11023
CVSS v3.1
6.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
jQuery versions 1.0.3 through 3.4.1
Description:
The issue arises from insufficient cleaning of user-provided data when passing HTML elements to jQuery's DOM manipulation methods, such as
.html() and .append(). This can allow an attacker to execute untrusted code, enabling cross-site scripting (XSS) attacks. The problem is patched in jQuery 3.5.0. To protect against this exploit, users can update to jQuery 3.5.0 or use DOMPurify for safer HTML handling. Agencies are urged to remediate by February 13, 2025.Recommendations:
For jQuery versions 1.0.3 through 3.4.1, update to jQuery 3.5.0 to fix the issue.
As a temporary workaround, consider using DOMPurify with its
SAFE FOR JQUERY option to sanitize the HTML string before passing it to a jQuery method.
Restrict access to the vulnerable DOM manipulation methods, such as .html() and .append(), to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Jira
Linuxmint
Oracle Weblogic Server
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Jquery