CVE-2020-23064: jQuery Cross Site Scripting vulnerability
Summary
CVE-2020-23064: jQuery Cross Site Scripting vulnerability. Affects jquery versions >= 2.2.0, < 3.5.0. Fixed in 3.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jQuery is a popular JavaScript library that simplifies HTML document traversal, event handling, and animation. It is widely used in web development to enhance user experience and streamline front-end development. However, versions 2.2.0 to 3.5.0 of jQuery are affected by a Cross Site Scripting (XSS) vulnerability. This vulnerability allows a remote attacker to execute arbitrary code by exploiting the <options> element.
Vulnerability Detail
The Cross Site Scripting vulnerability in jQuery versions 2.2.0 to 3.5.0 arises from a flaw in the jquery.htmlPrefilter function. By injecting malicious code through the <options> element, an attacker can execute arbitrary scripts within the context of the vulnerable application. This can lead to various security risks, including unauthorized data access, session hijacking, and defacement of web pages.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
npm install jquery@4.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.0
This is the first release that contains the fix.
npm install jquery@3.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version of jQuery is not immediately feasible, a temporary workaround is to manually sanitize user input and encode output to prevent XSS attacks. Here is an example of how to sanitize user input in JavaScript:
function sanitizeInput(input) {
return input.replace(/[&<>"'\/]/g, function (x) {
return {
'&': '&',
'<': '<',
'>': '>',
'"': '"',
"'": ''',
'/': '/'
}[x];
});
}
Remember to apply this sanitization function to any user-generated content that is rendered in HTML.
Conclusion
The jQuery Cross Site Scripting vulnerability (CVE-2020-23064) poses a moderate risk to web applications using affected versions of jQuery. It is crucial to upgrade to a fixed version of jQuery (3.5.1 or later) to mitigate the risk. Additionally, developers should sanitize user input and encode output to prevent XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jquery →
FAQ
The vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized data access, session hijacking, and defacement of web pages.
Versions 2.2.0 to 3.5.0 of jQuery are affected by this vulnerability.
Yes, the vulnerability has been fixed in jQuery versions 3.5.1 and later.
A temporary workaround is to manually sanitize user input and encode output to prevent XSS attacks. However, upgrading to a fixed version of jQuery is highly recommended.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for jquery.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
