Vulnerability advisory

GHSA-2pqj-h3vj-pqgw

Cross-Site Scripting in jquery

Published Sep 1, 2020Updated Mar 8, 2024OSV record ↗

Also known as CVE-2012-6708

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

jquery npm

All jquery advisories →

Affected	Fixed in
All versions before 1.9.0	`1.9.0`Advisories →

org.webjars.npm:jquery Maven

All org.webjars.npm:jquery advisories →

Affected	Fixed in
All versions before 1.9.0	`1.9.0`Advisories →
Also listed as affected (4) `1.7.2` `1.7.3` `1.8.2` `1.8.3`

jQuery NuGet

All jQuery advisories →

Affected	Fixed in
All versions before 1.9.0	`1.9.0`Advisories →
Also listed as affected (20) `1.4.1` `1.4.2` `1.4.3` `1.4.4` `1.5.0` `1.5.1` `1.5.2` `1.6.0` `1.6.1` `1.6.2` `1.6.3` `1.6.4` `1.7.0` `1.7.1` `1.7.1.1` `1.7.2` `1.8.0` `1.8.1` `1.8.2` `1.8.3`

jquery-rails RubyGems

All jquery-rails advisories →

Affected	Fixed in
All versions before 2.2.0	`2.2.0`Advisories →
Also listed as affected (40) `0.1.1` `0.1.2` `0.1.3` `0.2` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.2.5` `0.2.6` `0.2.7` `1.0` `1.0.1` `1.0.10` `1.0.11` `1.0.12` `1.0.13` `1.0.14` `1.0.15` `1.0.16` `1.0.17` `1.0.18` `1.0.19` `1.0.2` `1.0.3` `1.0.4` `1.0.5` `1.0.6` `1.0.7` `1.0.8` `1.0.9` `1.0.rc` `2.0.1` `2.0.2` `2.0.3` `2.1.0` `2.1.1` `2.1.2` `2.1.3` `2.1.4`

Description

Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that jquery may interpret HTML as selectors when given certain inputs, allowing for client side code execution.

Proof of Concept

$("#log").html(
    $("element[attribute='[image]']").html()
);

Recommendation

Update to version 1.9.0 or later.