CVE-2020-11022: Potential XSS vulnerability in jQuery
Summary
CVE-2020-11022: Potential XSS vulnerability in jQuery. Affects jquery versions >= 1.2.0, < 3.5.0. Fixed in 3.5.0. How to fix ↓
Also tracked for
- drupal · Bitnami
- node-jquery · Debian:11
The same CVE-2020-11022 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jQuery is a popular JavaScript library that simplifies HTML document traversal, event handling, and animation. It is widely used in web development to enhance user experience and streamline front-end development. However, versions prior to 3.5.0 are vulnerable to a potential cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises when untrusted HTML content is passed to jQuery's DOM manipulation methods, such as .html(), .append(), and others, even after sanitization. This can lead to the execution of untrusted code, compromising the security of the application. The vulnerability is assigned a CVSS score of 6.9, indicating a moderate severity level.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
npm install jquery@4.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.0
This is the first release that contains the fix.
npm install jquery@3.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, a workaround can be applied by adding the following code snippet to the application:
jQuery.htmlPrefilter = function( html ) {
return html;
};
This workaround should be used only if the application is using jQuery 1.12/2.2 or newer.
Conclusion
In conclusion, the potential XSS vulnerability in jQuery (CVE-2020-11022) can be mitigated by upgrading to version 3.5.0 or newer. Alternatively, the provided workaround can be applied if upgrading is not immediately feasible. It is important to address this vulnerability promptly to prevent potential cross-site scripting attacks. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for jquery →
FAQ
The vulnerability allows for the execution of untrusted code, potentially leading to cross-site scripting attacks. It can enable an attacker to inject malicious scripts into web pages viewed by users, compromising their sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Versions prior to 3.5.0 are affected by this vulnerability. It is recommended to upgrade to jQuery 3.5.0 or newer to mitigate the risk.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to address the vulnerability promptly to prevent potential attacks.
For more information, you can refer to the jQuery blog post at https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ and the jQuery upgrade guide at https://jquery.com/upgrade-guide/3.5/. If you have further questions or need assistance, you can search for relevant issues in the jQuery repository or open a new issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for jquery.
