Skip to content

Potential XSS vulnerability in jQuery

moderate severity Published Apr 29, 2020 in jquery/jquery • Updated Oct 21, 2021

Package

npm jquery (npm)

Affected versions

>= 1.2, < 3.5.0

Patched versions

3.5.0

Description

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

This problem is patched in jQuery 3.5.0.

Workarounds

To workaround the issue without upgrading, adding the following to your code:

jQuery.htmlPrefilter = function( html ) {
	return html;
};

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

References

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.

References

@timmywil timmywil published the maintainer security advisory Apr 29, 2020

CVE ID

CVE-2020-11022

CVSS Score

6.9 Moderate
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N