XSS via DOM

[cloudsorrow]

The method success() in jquery.pjax.js sends unvalidated data to a web browser on line 160, which can result in the browser executing malicious code.

In jquery-pjax.js, line 160, the success method doesn't properly validate the malicious input returned from making the hash. Mind you, it is only as strong as the client protections enabled on the browser.

[josh]

$.pjax functions the same way as $.ajax. Since it only allows same origin resources, its always coming from your server.