jQuery < 3.5.0 Cross-Site Scripting: update jQuery

[maradragan]

jQuery < 3.5.0 Cross-Site Scripting

There is a flaw in the jQuery.htmlPrefilter method that is used when displaying elements constructed with the jQuery('') technique. Vulnerable applications passing untrusted data into this method may be vulnerable to cross-site scripting attacks. An attacker can abuse this to attack the user, gain access to their private data, and execute application features with the victim's privileges.

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

[zhenchengzj]

good questions