CVE-2020-11023
Potential XSS vulnerability in jQuery
Using jQuery by jquery?
Get instant alerts when new vulnerabilities affect jQuery - before attackers find them.
Actively Exploited
CISA Known Exploited Vulnerabilities (KEV) Catalog
EPSS (Exploit Prediction Scoring System) estimates a 84.9% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.
JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released
- https://jquery.com/upgrade-guide/3.5/
References (67)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.