Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

Workarounds

Apply octobercms/october@5c7ba9f to your installation manually if unable to upgrade to Build 466.

References

• GHSA-gxr4-xjj5-5px2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
• https://jquery.com/upgrade-guide/3.5/

For more information

If you have any questions or comments about this advisory:

• Email us at octobercms@luketowers.ca & hello@octobercms.com

Threat Assessment

Assessed as Moderate by the @jquery team.

Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.

References

• GHSA-v73w-r9xg-7cr9
• octobercms/october#5097
• octobercms/october@5c7ba9f