PT-2024-40348 · Jquery · Jquery

Published 2024-06-05 · Updated 2024-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions jQuery versions 1.0.3 through 3.4.1 jQuery versions prior to 3.5.0

Description The issue allows execution of untrusted code when HTML from untrusted sources is passed to jQuery's DOM manipulation methods, such as .html() or .append(), even after sanitization.

Recommendations For jQuery versions 1.0.3 through 3.4.1, update to version 3.5.0 or later to resolve the issue. For jQuery versions prior to 3.5.0, update to version 3.5.0 or later to resolve the issue.

Related Identifiers

GHSA-JMH9-6RJQ-GJH9

Affected Products

Jquery

References · 3

• https://osv.dev/vulnerability/GHSA-jmh9-6rjq-gjh9 · Vendor Advisory
• https://github.com/pimcore/admin-ui-classic-bundle · Note
• https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jmh9-6rjq-gjh9 · Note