DemoBook a demo

Vulnerability advisory

CVE-2020-7656

Published Updated OSV record ↗

Also known as GHSA-q4m3-2j7h-f7xwSNYK-JS-JQUERY-569619

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/jquery/jquery ↗
All commits before 6361fdf2f30e41f565a953eb120f795774c65c4e6361fdf2f30e41f565a953eb120f795774c65c4e
Also listed as affected (59)
  • 1.9.0rc1
  • 1.9.0b1
  • 1.8rc1
  • 1.8b2
  • 1.8b1
  • 1.7.2rc1
  • 1.7.2b1
  • 1.7.1rc1
  • 1.7rc1
  • 1.7b2
  • 1.7b1
  • 1.6.4rc1
  • 1.6.3rc1
  • 1.6.2rc1
  • 1.6.1rc1
  • 1.6rc1
  • 1.6b1
  • 1.5.2rc1
  • 1.5.1rc1
  • 1.5rc1
  • 1.5b1
  • 1.4.4rc3
  • 1.4.4rc2
  • 1.4.4rc1
  • 1.4.3rc2
  • 1.4.3rc1
  • 1.4rc1
  • 1.4a2
  • 1.4a1
  • 1.3.1rc1
  • 1.3rc1
  • 1.3b2
  • 1.3b1
  • 1.2.5
  • 1.2.4
  • 1.2.4b
  • 1.2.4a
  • 1.2.3b
  • 1.2.3a
  • 1.2.2
  • 1.2.2b2
  • 1.2.2b
  • 1.2.1
  • 1.2
  • 1.1.4
  • 1.1.3.1
  • 1.1.3
  • 1.1.3a
  • 1.1.2
  • 1.1.1
  • 1.1
  • 1.1b
  • 1.1a
  • 1.0.4
  • 1.0.3
  • 1.0.2
  • 1.0.1
  • 1.0
  • 1.0a

Description

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.