DemoBook a demo

Vulnerability advisory

CVE-2019-11358

Published Updated OSV record ↗

Also known as DRUPAL-CORE-2019-006GHSA-6c3j-c64m-qhgqPYSEC-2026-628SNYK-JS-JQUERY-174006

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/backdrop/backdrop ↗
963141d57d9ba861216fa85bf8a135f65d2c06be to before 17198299114cf7c5c88a1bdf597a74734751687d17198299114cf7c5c88a1bdf597a74734751687d
b7f9a6908911617be8f83ea1d7daaa3be2453874 to before 8e7a1b9546d32ac84f7bfaaaf3ee2439ba7b0c1a8e7a1b9546d32ac84f7bfaaaf3ee2439ba7b0c1a
Also listed as affected (15)
  • 1.11.8
  • 1.12.5
  • 1.11.7
  • 1.12.4
  • 1.12.3
  • 1.11.6
  • 1.12.2
  • 1.11.5
  • 1.12.1
  • 1.12.0
  • 1.11.4
  • 1.11.3
  • 1.11.2
  • 1.11.1
  • 1.11.0
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before 9735baff3afe061f98e568c1d1f83d56f3a0212a9735baff3afe061f98e568c1d1f83d56f3a0212a
b73ab73d39dca97a12513e8a9e4f4da4b0676f5f to before c5bc3922f27c93ab3669428a504212adb801400fc5bc3922f27c93ab3669428a504212adb801400f
9b04d294324d9c76be4b596de4316cb8804e8223 to before 91ded4b7776e05ee9633bdc1c458b41c718133e091ded4b7776e05ee9633bdc1c458b41c718133e0
Also listed as affected (47)
  • 7.65
  • 8.5.14
  • 8.6.14
  • 7.64
  • 8.5.13
  • 8.6.12
  • 8.5.12
  • 8.6.11
  • 8.6.9
  • 8.6.8
  • 7.61
  • 8.6.5
  • 8.6.4
  • 8.6.3
  • 8.6.1
  • 8.5.7
  • 8.6.0
  • 8.5.5
  • 8.5.4
  • 8.5.0
  • 7.56
  • 7.55
  • 7.54
  • 7.51
  • 7.50
  • 7.43
  • 7.42
  • 7.40
  • 7.37
  • 7.36
  • 7.33
  • 7.30
  • 7.28
  • 7.25
  • 7.23
  • 7.22
  • 7.17
  • 7.15
  • 7.14
  • 7.12
  • 7.10
  • 7.9
  • 7.8
  • 7.7
  • 7.6
  • 7.4
  • 7.0
GIT github.com/joomla/joomla-cms ↗
c1acb7e6973bd549fe35a02659fe851ff1a37dfe through bbdf775fbee26d275ce60ea466b778e4694210a1No fix listed
Also listed as affected (126)
  • 3.9.4
  • 3.9.3
  • 3.9.2-rc
  • 3.9.1
  • 3.9.0
  • 3.9.0-rc
  • 3.9.0-beta4
  • 3.9.4-rc
  • 3.8.11
  • 3.9.3-rc
  • 3.9.2
  • 3.8.8
  • 3.9.1-rc
  • 3.9.0-rc2
  • 3.8.7
  • 3.8.12
  • 3.9.0-beta3
  • 3.9.0-beta2
  • 3.9.0-beta
  • 3.8.12-rc
  • 3.8.11-rc
  • 3.8.6
  • 3.8.10
  • 3.8.9
  • 3.8.4
  • 3.8.9-rc
  • issues-241-257
  • 3.8.8-rc
  • 3.8.7-rc
  • 3.8.6-rc1
  • 3.8.3
  • 3.8.3-rc
  • 3.8.5
  • 3.8.5-rc
  • 3.8.4-rc2
  • 3.8.4-rc
  • 3.8.2
  • 3.8.1
  • 3.8.0
  • 3.8.2-rc
  • 3.8.1-rc
  • 3.8.0-rc1
  • 3.8.0-beta2
  • 3.8.0-beta4
  • 3.8.0-beta1
  • 3.8.0-beta3
  • 3.7.4-rc1
  • 3.7.4-beta1
  • 3.7.3
  • 3.7.3-rc2
  • 3.7.3-rc1
  • 3.7.3-beta1
  • 3.7.2
  • 3.7.1
  • 3.7.1-rc2
  • 3.7.1-rc1
  • 3.7.0
  • 3.7.0-rc4
  • 3.7.0-rc3
  • 3.7.0-rc2
  • 3.7.0-rc1
  • 3.7.0-beta4
  • 3.7.0-beta3
  • 3.7.0-beta2
  • 3.7.0-beta1
  • 3.7.0-alpha1
  • 3.6.3
  • 3.6.3-rc3
  • 3.6.3-rc2
  • 3.6.3-rc1
  • 3.6.2
  • 3.6.1
  • 3.6.1-rc2
  • 3.6.1-rc1
  • 3.6.0
  • 3.6.0-rc2
  • 3.6.0-rc
  • 3.6.0-beta2
  • 3.6.0-beta1
  • 3.6.0-alpha
  • 3.5.1
  • 3.5.1-rc2
  • 3.5.1-rc
  • 3.5.0
  • 3.5.0-rc4
  • 3.5.0-rc2
  • 3.5.0-rc
  • 3.5.0-beta5
  • 3.5.0-beta4
  • 3.5.0-beta3
  • 3.5.0-beta2
  • 3.4.5
  • 3.5.0-beta
  • 3.4.4
  • 3.4.4-rc2
  • 3.4.4-rc
  • 3.4.3
  • 3.4.2
  • 3.4.2-rc
  • 3.4.1
  • 3.4.1-rc2
  • 3.4.1-rc
  • 3.4.0
  • 3.4.0-rc
  • 3.4.0-beta3
  • 3.4.0-beta2
  • 3.4.0-beta1
  • 3.2.4
  • 3.3.0
  • 3.2.3
  • 3.2.2
  • 3.2.1
  • 3.2.0
  • 3.1.5
  • 3.2.0.rc
  • 3.2.0.beta
  • 3.2.0.alpha
  • 3.1.1
  • 3.0.3
  • 3.1.0_beta5
  • 3.1.0_beta4
  • 3.1.0_beta3
  • 3.1.0_beta2
  • 3.1.0_beta1
  • 3.0.1
  • 3.0.0
GIT github.com/jquery/jquery ↗
All commits before b7fc909edda2d8cf63d0eaffe9bd12f33e492ad3b7fc909edda2d8cf63d0eaffe9bd12f33e492ad3
Not specified753d591aea698e57d6db58c9f722cd0808619b1b
Also listed as affected (62)
  • 2.1.0-beta1
  • 2.0.0-beta3
  • 2.0.0b2
  • 2.0.0b1
  • 1.9.0b1
  • 1.8rc1
  • 1.8b2
  • 1.8b1
  • 1.7.2rc1
  • 1.7.2b1
  • 1.7.1rc1
  • 1.7rc1
  • 1.7b2
  • 1.7b1
  • 1.6.4rc1
  • 1.6.3rc1
  • 1.6.2rc1
  • 1.6.1rc1
  • 1.6rc1
  • 1.6b1
  • 1.5.2rc1
  • 1.5.1rc1
  • 1.5rc1
  • 1.5b1
  • 1.4.4rc3
  • 1.4.4rc2
  • 1.4.4rc1
  • 1.4.3rc2
  • 1.4.3rc1
  • 1.4rc1
  • 1.4a2
  • 1.4a1
  • 1.3.1rc1
  • 1.3rc1
  • 1.3b2
  • 1.3b1
  • 1.2.5
  • 1.2.4
  • 1.2.4b
  • 1.2.4a
  • 1.2.3b
  • 1.2.3a
  • 1.2.2
  • 1.2.2b2
  • 1.2.2b
  • 1.2.1
  • 1.2
  • 1.1.4
  • 1.1.3.1
  • 1.1.3
  • 1.1.3a
  • 1.1.2
  • 1.1.1
  • 1.1
  • 1.1b
  • 1.1a
  • 1.0.4
  • 1.0.3
  • 1.0.2
  • 1.0.1
  • 1.0
  • 1.0a

Description

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.