Skip to content

Upgrade jQuery to 3.4 #1581

Closed
Closed
Upgrade jQuery to 3.4#1581
Milestone
0.15.5

Description

@Cerebus
Cerebus
opened on Jun 7, 2019

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

https://nvd.nist.gov/vuln/detail/CVE-2019-11358

Activity

  1. davidism commented on Jun 7, 2019

    @davidism
    davidism
    on Jun 7, 2019
    Member

    jQuery as used in Werkzeug is not vulnerable to this. You're welcome to open a PR to upgrade the bundled version though.

  2. davidism
    closed this as completedon Jun 7, 2019
  3. Cerebus
    added a commit that references this issue on Jun 8, 2019

    Update to jQuery 3.4.1, fixes pallets#1581

    ec9b1ce
  4. davidism
    added this to the 0.15.5 milestone on Jul 12, 2019
  5. davidism
    added a commit that references this issue on Jul 12, 2019

    Merge pull request #1582 from Cerebus/fix/1581-jquery-3.4.1

    8afe4eb
  6. github-actions
    locked as resolved and limited conversation to collaborators on Nov 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions