DemoBook a demo

Vulnerability advisory

CVE-2020-11022

Published Updated OSV record ↗

Also known as BIT-drupal-2020-11022GHSA-gxr4-xjj5-5px2

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before c62d5ba13e02923cf4f6e2a7ede0d2afcaa68043c62d5ba13e02923cf4f6e2a7ede0d2afcaa68043
17ba30046ed57677de4feff8d07354890b40efdb to before ee0693f6d6bdc5cd772e163e6ed410567d82d33fee0693f6d6bdc5cd772e163e6ed410567d82d33f
f2b59e3ae8097ea01d15c708f1267b73794399c0 to before ed3ab8ae68db8942877b5d6d8f3f91f090cd63fbed3ab8ae68db8942877b5d6d8f3f91f090cd63fb
Also listed as affected (84)
  • 8.7.13
  • 8.8.5
  • 7.69
  • 8.8.3
  • 8.8.2
  • 8.8.0
  • 7.68
  • 8.7.10
  • 8.7.9
  • 8.7.8
  • 8.7.7
  • 8.7.6
  • 8.7.4
  • 8.7.3
  • 8.7.2
  • 8.7.0-rc1
  • 8.7.0-beta2
  • 8.7.0-beta1
  • 8.7.0-alpha2
  • 7.64
  • 8.7.0-alpha1
  • 7.61
  • 7.56
  • 7.55
  • 7.54
  • 7.51
  • 7.50
  • 7.43
  • 8.1.0-beta1
  • 7.42
  • 8.0.0
  • 8.0.0-rc4
  • 8.0.0-rc3
  • 8.0.0-rc2
  • 7.40
  • 8.0.0-rc1
  • 8.0.0-beta16
  • 8.0.0-beta15
  • 8.0.0-beta14
  • 8.0.0-beta13
  • 8.0.0-beta12
  • 7.37
  • 8.0.0-beta11
  • 8.0.0-beta10
  • 7.36
  • 8.0.0-beta9
  • 8.0.0-beta7
  • 8.0.0-beta6
  • 8.0.0-beta5
  • 8.0.0-beta4
  • 7.33
  • 8.0.0-beta3
  • 8.0.0-beta2
  • 8.0.0-beta1
  • 8.0.0-alpha15
  • 8.0.0-alpha14
  • 7.30
  • 7.28
  • 8.0-alpha13
  • 8.0-alpha12
  • 8.0-alpha11
  • 8.0-alpha10
  • 8.0-alpha9
  • 8.0-alpha8
  • 7.25
  • 8.0-alpha7
  • 8.0-alpha6
  • 7.23
  • 8.0-alpha5
  • 8.0-alpha4
  • 8.0-alpha3
  • 8.0-alpha2
  • 7.22
  • 7.17
  • 7.15
  • 7.14
  • 7.12
  • 7.10
  • 7.9
  • 7.8
  • 7.7
  • 7.6
  • 7.4
  • 7.0
GIT github.com/jquery/jquery ↗
ce256312d518e16a6ee7df5f7f301b8bf9a1caf2 to before 7a0a850f3d41c0412609c1d32b1e602d4afe2f4e7a0a850f3d41c0412609c1d32b1e602d4afe2f4e
Not specified1d61fd9407e6fbe82fe55cb0b938307aa0791f77
Also listed as affected (47)
  • 2.1.0-beta1
  • 2.0.0-beta3
  • 2.0.0b2
  • 2.0.0b1
  • 1.9.0b1
  • 1.8rc1
  • 1.8b2
  • 1.8b1
  • 1.7.2rc1
  • 1.7.2b1
  • 1.7.1rc1
  • 1.7rc1
  • 1.7b2
  • 1.7b1
  • 1.6.4rc1
  • 1.6.3rc1
  • 1.6.2rc1
  • 1.6.1rc1
  • 1.6rc1
  • 1.6b1
  • 1.5.2rc1
  • 1.5.1rc1
  • 1.5rc1
  • 1.5b1
  • 1.4.4rc3
  • 1.4.4rc2
  • 1.4.4rc1
  • 1.4.3rc2
  • 1.4.3rc1
  • 1.4rc1
  • 1.4a2
  • 1.4a1
  • 1.3.1rc1
  • 1.3rc1
  • 1.3b2
  • 1.3b1
  • 1.2.5
  • 1.2.4
  • 1.2.4b
  • 1.2.4a
  • 1.2.3b
  • 1.2.3a
  • 1.2.2
  • 1.2.2b2
  • 1.2.2b
  • 1.2.1
  • 1.2
GIT github.com/php-debugbar/php-debugbar ↗
fbbde43c8f0f8a5f2a17c38a38a387d7641baa12 through 0251ce5766de35e59e23078e36b3ef56ed437aceNo fix listed
18ced90d4b882ed449b2278fea8692f8f7d1c13c through 18ced90d4b882ed449b2278fea8692f8f7d1c13cNo fix listed
Not specified847216e60544258c881f2733d699bbcfeefac0fc
Also listed as affected (13)
  • 3.8m0
  • v3.8.0
  • v3.1.3
  • v3.1.2
  • v3.1.1
  • v3.1.0
  • v3.0.6
  • v3.0.5
  • v3.0.4
  • v3.0.3
  • v3.0.2
  • v3.0.1
  • v3.0.0

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.