Vulnerability advisory

GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery

Published Apr 29, 2020Updated Sep 10, 2026OSV record ↗

Also known as BIT-drupal-2020-11023CVE-2020-11023

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H

Affected versions

jquery npm

All jquery advisories →

Affected	Fixed in
`1.0.3` to before 3.5.0	`3.5.0`Advisories →

jquery-rails RubyGems

All jquery-rails advisories →

Affected Fixed in

All versions before 4.4.0 4.4.0Advisories →

Affected	Fixed in
All versions before 4.4.0	`4.4.0`Advisories →
Also listed as affected (74) `0.1.1` `0.1.2` `0.1.3` `0.2` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.2.5` `0.2.6` `0.2.7` `1.0` `1.0.1` `1.0.10` `1.0.11` `1.0.12` `1.0.13` `1.0.14` `1.0.15` `1.0.16` `1.0.17` `1.0.18` `1.0.19` `1.0.2` `1.0.3` `1.0.4` `1.0.5` `1.0.6` `1.0.7` `1.0.8` `1.0.9` `1.0.rc` `2.0.1` `2.0.2` `2.0.3` `2.1.0` `2.1.1` `2.1.2` `2.1.3` `2.1.4` `2.2.0` `2.2.1` `2.2.2` `2.3.0` `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.0.4` `3.1.0` `3.1.1` `3.1.2` `3.1.3` `3.1.4` `3.1.5` `4.0.0` `4.0.0.beta1` `4.0.0.beta2` `4.0.1` `4.0.2` `4.0.3` `4.0.4` `4.0.5` `4.1.0` `4.1.1` `4.2.0` `4.2.1` `4.2.2` `4.3.0` `4.3.1` `4.3.2` `4.3.3` `4.3.4` `4.3.5`

Also listed as affected (74)

jQuery NuGet

All jQuery advisories →

Affected Fixed in

1.0.3 to before 3.5.0 3.5.0Advisories →

Also listed as affected (58)

org.webjars.npm:jquery Maven

All org.webjars.npm:jquery advisories →

Affected	Fixed in
`1.0.3` to before 3.5.0	`3.5.0`Advisories →
Also listed as affected (35) `1.11.0` `1.11.1` `1.11.3` `1.12.1` `1.12.2` `1.12.3` `1.12.4` `1.7.2` `1.7.3` `1.8.2` `1.8.3` `1.9.1` `2.1.0` `2.1.1` `2.1.1-rc1` `2.1.1-rc2` `2.1.3` `2.1.4` `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `3.0.0` `3.0.0-alpha1` `3.0.0-beta1` `3.0.0-rc1` `3.1.0` `3.1.1` `3.2.0` `3.2.1` `3.3.0` `3.3.1` `3.4.0` `3.4.1`

components/jquery Packagist

All components/jquery advisories →

Affected	Fixed in
`1.0.3` to before 3.5.0	`3.5.0`Advisories →
Also listed as affected (31) `1.10.0` `1.10.1` `1.10.2` `1.11.0` `1.11.1` `1.11.2` `1.11.3` `1.12.0` `1.12.1` `1.12.4` `1.8.3` `1.9.0` `1.9.1` `2.0.0` `2.0.1` `2.0.2` `2.0.3` `2.1.0` `2.1.1` `2.1.3` `2.1.4` `2.2.0` `2.2.1` `2.2.4` `3.0.0` `3.1.0` `3.1.1` `3.2.0` `3.2.1` `3.3.1` `3.4.1`

Description

Impact

Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

This problem is patched in jQuery 3.5.0.

Workarounds

To workaround this issue without upgrading, use DOMPurify with its SAFE_FOR_JQUERY option to sanitize the HTML string before passing it to a jQuery method.

References

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.