PT-2020-6938 · Jquery · Jquery

Published 2020-04-10 · Updated 2025-09-29 · CVE-2020-23064

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions jQuery versions 2.2.0 through 3.5.0

Description The issue is related to Cross Site Scripting vulnerability, which allows a remote attacker to execute arbitrary code via the <option> element. Passing HTML containing <option> elements from untrusted sources to one of jQuery's DOM manipulation methods, such as .html() or .append(), may execute untrusted code.

Recommendations To resolve the issue, update to jQuery 3.5.0 or later. As a temporary workaround, use DOMPurify with its SAFE FOR JQUERY option to sanitize the HTML string before passing it to a jQuery method.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2025_1210

ALSA-2025_1215

ALSA-2025_1300

ALSA-2025_1301

ALSA-2025_1306

ALSA-2025_1309

ALSA-2025_1314

ALSA-2025_1329

ALSA-2025_1338

ALSA-2025_1346

ALSA-2025_16880

BDU:2023-07697

CVE-2020-23064

GHSA-257Q-PV89-V3XV

GHSA-JPCQ-CGW6-V4J6

OESA-2023-1446

OESA-2023-1447

Affected Products

Jquery

References · 135

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-23064.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11023.yml · Exploit
• https://osv.dev/vulnerability/GHSA-257q-pv89-v3xv · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07697 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1446 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11023 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-23064 · Security Note
• https://debian.org/security/2020/dsa-4693 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-23064 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B · Vendor Advisory