CVE-2020-23064: jQuery Cross Site Scripting vulnerability
Summary
GHSA-257q-pv89-v3xv: Duplicate Advisory: jQuery Cross Site Scripting vulnerability. Affects jquery versions >= 1.0.3, < 3.5.0. Fixed in 3.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jQuery is a popular JavaScript library that simplifies HTML document traversal, event handling, and animation for web development. It is widely used to enhance the functionality and user experience of websites. However, versions 2.2.0 to 3.5.0 of jQuery are susceptible to a Cross Site Scripting (XSS) vulnerability. This vulnerability allows remote attackers to execute arbitrary code by exploiting the <options> element.
Vulnerability Detail
The jQuery XSS vulnerability (CVE-2020-23064) arises due to inadequate input sanitization in the .htmlPrefilter function. This function is responsible for processing HTML strings before they are inserted into the DOM. By crafting malicious input, an attacker can inject arbitrary JavaScript code into a web page, potentially leading to session hijacking, data theft, or other malicious activities. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
npm install jquery@4.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.0
This is the first release that contains the fix.
npm install jquery@3.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of jQuery is not feasible immediately, developers can implement a workaround by manually sanitizing user input before using it in jQuery functions. This can be achieved by using a library or custom code that escapes special characters and removes potentially dangerous HTML tags. Here is an example of a JavaScript function that sanitizes user input:
function sanitizeInput(input) {
return input.replace(/[&<>"'\/]/g, function (char) {
return {
'&': '&',
'<': '<',
'>': '>',
'"': '"',
'\'': ''',
'/': '/'
}[char];
});
}
By using this function to sanitize user input before passing it to jQuery functions, the risk of XSS attacks can be mitigated.
Conclusion
The jQuery Cross Site Scripting vulnerability (CVE-2020-23064) poses a moderate risk to web applications using affected versions of jQuery. To mitigate this vulnerability, it is crucial to upgrade to jQuery version 3.5.0 or higher and ensure proper input sanitization. Developers should also stay informed about security updates and best practices to protect their applications from potential XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jquery →
FAQ
The vulnerability allows attackers to execute arbitrary code on a web page, potentially leading to session hijacking, data theft, or other malicious activities.
Versions 2.2.0 to 3.5.0 of jQuery are affected by this vulnerability.
Yes, there are known exploits for this vulnerability. Attackers can craft malicious input to inject arbitrary JavaScript code into vulnerable web pages.
Yes, the vulnerability has been fixed in jQuery version 3.5.0. It is recommended to upgrade to this version or higher to mitigate the risk.
Yes, developers can implement a workaround by manually sanitizing user input before using it in jQuery functions. This involves escaping special characters and removing potentially dangerous HTML tags.
Related vulnerabilities
Recent vulnerabilities recorded for jquery.
