PT-2020-6926 · Jquery+5 · Jquery+5

Published 2020-05-19 · Updated 2025-09-29 · CVE-2020-7656

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions jquery versions prior to 1.9.0

Description The issue allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendations Upgrade to version 1.9.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2021:4142

ALSA-2025_16880

BDU:2023-07536

CESA-2021_4142

CVE-2020-7656

GHSA-Q4M3-2J7H-F7XW

RHSA-2020:4211

RHSA-2021:4142

RHSA-2021_4142

RLSA-2021:4142

SNYK-JS-JQUERY-569619

Affected Products

Almalinux

Centos

Junos

Red Hat

Rocky Linux

Jquery

References · 53

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-7656.yml · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-JQUERY-569619 · Exploit
• 🔥 https://exploit-db.com/exploits/52141 · Exploit
• https://osv.dev/vulnerability/CVE-2020-7656 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07536 · Security Note
• https://osv.dev/vulnerability/ALSA-2021:4142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7656 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7656 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4142 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4142 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7656 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7656 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-9552.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4m3-2j7h-f7xw · Vendor Advisory
• https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d · Note