CVE-2025-3573: jquery-validation Cross-site Scripting Vulnerability
Summary
CVE-2025-3573: jquery-validation vulnerable to Cross-site Scripting. Affects jquery-validation versions < 1.20.0. Fixed in 1.20.0. How to fix ↓
Also tracked for
- civicrm · Debian:11
The same CVE-2025-3573 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jquery-validation is a popular JavaScript library used for client-side form validation. It allows developers to enforce rules on form inputs, providing user-friendly error messages and enhancing the overall user experience. However, certain versions of this package are susceptible to a Cross-site Scripting (XSS) vulnerability, which can be exploited if user-controlled input is not properly sanitized.
Vulnerability Detail
The vulnerability arises from the showLabel() function in jquery-validation, which can accept a user-controlled placeholder value. If this value is not adequately sanitized, it can lead to XSS attacks, allowing malicious users to inject scripts into web pages viewed by other users. This can result in unauthorized actions being performed on behalf of users, data theft, or other malicious activities.
How To Fix
Latest published version: 1.22.1 as of 23 Oct 2026
npm install jquery-validation@1.22.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.0
This is the first release that contains the fix.
npm install jquery-validation@1.20.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider sanitizing user inputs before they are passed to the showLabel() function. This can be done using a library like DOMPurify to clean the input. Example code:
const cleanInput = DOMPurify.sanitize(userInput);
showLabel(cleanInput);
Conclusion
The jquery-validation package has a vulnerability that can lead to Cross-site Scripting attacks if not addressed. It is crucial to update to version 1.20.0 or later to protect your application from potential exploits. Additionally, consider implementing input sanitization as a temporary measure.
See every vulnerability recorded for jquery-validation →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
Versions of jquery-validation before 1.20.0 are vulnerable to this XSS issue.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
If an immediate update is not possible, ensure to sanitize user inputs to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for jquery-validation.
