DemoBook a demo

Vulnerability advisory

CVE-2020-11023

Published Updated OSV record ↗

Also known as BIT-drupal-2020-11023GHSA-jpcq-cgw6-v4j6

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before c62d5ba13e02923cf4f6e2a7ede0d2afcaa68043c62d5ba13e02923cf4f6e2a7ede0d2afcaa68043
17ba30046ed57677de4feff8d07354890b40efdb to before ee0693f6d6bdc5cd772e163e6ed410567d82d33fee0693f6d6bdc5cd772e163e6ed410567d82d33f
f2b59e3ae8097ea01d15c708f1267b73794399c0 to before ed3ab8ae68db8942877b5d6d8f3f91f090cd63fbed3ab8ae68db8942877b5d6d8f3f91f090cd63fb
Also listed as affected (84)
  • 8.7.13
  • 8.8.5
  • 7.69
  • 8.8.3
  • 8.8.2
  • 8.8.0
  • 7.68
  • 8.7.10
  • 8.7.9
  • 8.7.8
  • 8.7.7
  • 8.7.6
  • 8.7.4
  • 8.7.3
  • 8.7.2
  • 8.7.0-rc1
  • 8.7.0-beta2
  • 8.7.0-beta1
  • 8.7.0-alpha2
  • 7.64
  • 8.7.0-alpha1
  • 7.61
  • 7.56
  • 7.55
  • 7.54
  • 7.51
  • 7.50
  • 7.43
  • 8.1.0-beta1
  • 7.42
  • 8.0.0
  • 8.0.0-rc4
  • 8.0.0-rc3
  • 8.0.0-rc2
  • 7.40
  • 8.0.0-rc1
  • 8.0.0-beta16
  • 8.0.0-beta15
  • 8.0.0-beta14
  • 8.0.0-beta13
  • 8.0.0-beta12
  • 7.37
  • 8.0.0-beta11
  • 8.0.0-beta10
  • 7.36
  • 8.0.0-beta9
  • 8.0.0-beta7
  • 8.0.0-beta6
  • 8.0.0-beta5
  • 8.0.0-beta4
  • 7.33
  • 8.0.0-beta3
  • 8.0.0-beta2
  • 8.0.0-beta1
  • 8.0.0-alpha15
  • 8.0.0-alpha14
  • 7.30
  • 7.28
  • 8.0-alpha13
  • 8.0-alpha12
  • 8.0-alpha11
  • 8.0-alpha10
  • 8.0-alpha9
  • 8.0-alpha8
  • 7.25
  • 8.0-alpha7
  • 8.0-alpha6
  • 7.23
  • 8.0-alpha5
  • 8.0-alpha4
  • 8.0-alpha3
  • 8.0-alpha2
  • 7.22
  • 7.17
  • 7.15
  • 7.14
  • 7.12
  • 7.10
  • 7.9
  • 7.8
  • 7.7
  • 7.6
  • 7.4
  • 7.0
GIT github.com/jquery/jquery ↗
4e3da33c59fafe34e237585743e86e24ba81046e to before 7a0a850f3d41c0412609c1d32b1e602d4afe2f4e7a0a850f3d41c0412609c1d32b1e602d4afe2f4e
Also listed as affected (58)
  • 2.1.0-beta1
  • 2.0.0-beta3
  • 2.0.0b2
  • 2.0.0b1
  • 1.9.0b1
  • 1.8rc1
  • 1.8b2
  • 1.8b1
  • 1.7.2rc1
  • 1.7.2b1
  • 1.7.1rc1
  • 1.7rc1
  • 1.7b2
  • 1.7b1
  • 1.6.4rc1
  • 1.6.3rc1
  • 1.6.2rc1
  • 1.6.1rc1
  • 1.6rc1
  • 1.6b1
  • 1.5.2rc1
  • 1.5.1rc1
  • 1.5rc1
  • 1.5b1
  • 1.4.4rc3
  • 1.4.4rc2
  • 1.4.4rc1
  • 1.4.3rc2
  • 1.4.3rc1
  • 1.4rc1
  • 1.4a2
  • 1.4a1
  • 1.3.1rc1
  • 1.3rc1
  • 1.3b2
  • 1.3b1
  • 1.2.5
  • 1.2.4
  • 1.2.4b
  • 1.2.4a
  • 1.2.3b
  • 1.2.3a
  • 1.2.2
  • 1.2.2b2
  • 1.2.2b
  • 1.2.1
  • 1.2
  • 1.1.4
  • 1.1.3.1
  • 1.1.3
  • 1.1.3a
  • 1.1.2
  • 1.1.1
  • 1.1
  • 1.1b
  • 1.1a
  • 1.0.4
  • 1.0.3

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.