CVE-2019-5428: Prototype Pollution in jquery
Summary
GHSA-wv67-q8rr-grjp: Duplicate Advisory: Prototype Pollution in jquery. Affects jquery versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jquery package is a popular JavaScript library that simplifies HTML document traversal, event handling, and animation. It provides an easy-to-use API for manipulating and interacting with web pages. However, versions prior to 3.4.0 are vulnerable to Prototype Pollution. This vulnerability arises from the extend() method, which allows an attacker to modify the prototype for Object, leading to changes in properties that will exist on all objects.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can inject properties into existing JavaScript objects. In the case of jquery, the extend() method can be abused to modify the prototype of Object, enabling an attacker to pollute the prototype chain and introduce malicious properties. This can lead to various security issues, such as remote code execution, information disclosure, or denial of service attacks. It is important to note that this vulnerability affects all objects in the application that rely on the modified prototype.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
npm install jquery@4.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
npm install jquery@3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched version of jquery to fully address the issue.
Conclusion
Prototype Pollution in jquery (CVE-2019-5428) is a serious vulnerability that can lead to various security issues. It is recommended to upgrade to version 3.4.0 or later of the jquery package to mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jquery →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to inject properties into existing JavaScript objects, potentially leading to security issues.
The extend() method in jquery can be abused by an attacker to modify the prototype of Object, introducing malicious properties and polluting the prototype chain.
Prototype Pollution in jquery can result in various security issues, including remote code execution, information disclosure, or denial of service attacks.
Versions of jquery prior to 3.4.0 are vulnerable to Prototype Pollution.
To mitigate the risk of Prototype Pollution, it is crucial to upgrade to version 3.4.0 or later of the jquery package.
Related vulnerabilities
Recent vulnerabilities recorded for jquery.
