Cross-site Scripting (XSS) Affecting jquery package, versions >=1.5.1 <3.5.0
Threat Intelligence
Exploit Maturity
Mature
EPSS
6.27% (94th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JQUERY-567880
- published 29 Apr 2020
- disclosed 29 Apr 2020
- credit Masato Kinugawa
Introduced: 29 Apr 2020
CVE-2020-11022 Open this link in a new tabHow to fix?
Upgrade jquery to version 3.5.0 or higher.
Overview
jquery is a package that makes things like HTML document traversal and manipulation, event handling, animation, and Ajax much simpler with an easy-to-use API that works across a multitude of browsers.
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
CVSS Scores
version 3.1