Vulnerability advisory

GHSA-q4m3-2j7h-f7xw

Cross-Site Scripting in jquery

Published May 20, 2020Updated Jul 8, 2026OSV record ↗

Also known as CVE-2020-7656SNYK-JS-JQUERY-569619

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected versions

jquery npm

All jquery advisories →

Affected	Fixed in
`1.2.1` to before 1.9.0	`1.9.0`Advisories →

jQuery NuGet

All jQuery advisories →

Affected	Fixed in
`1.2.1` to before 1.9.0	`1.9.0`Advisories →
Also listed as affected (20) `1.4.1` `1.4.2` `1.4.3` `1.4.4` `1.5.0` `1.5.1` `1.5.2` `1.6.0` `1.6.1` `1.6.2` `1.6.3` `1.6.4` `1.7.0` `1.7.1` `1.7.1.1` `1.7.2` `1.8.0` `1.8.1` `1.8.2` `1.8.3`

jquery-rails RubyGems

All jquery-rails advisories →

Affected	Fixed in
All versions before 2.2.0	`2.2.0`Advisories →
Also listed as affected (40) `0.1.1` `0.1.2` `0.1.3` `0.2` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.2.5` `0.2.6` `0.2.7` `1.0` `1.0.1` `1.0.10` `1.0.11` `1.0.12` `1.0.13` `1.0.14` `1.0.15` `1.0.16` `1.0.17` `1.0.18` `1.0.19` `1.0.2` `1.0.3` `1.0.4` `1.0.5` `1.0.6` `1.0.7` `1.0.8` `1.0.9` `1.0.rc` `2.0.1` `2.0.2` `2.0.3` `2.1.0` `2.1.1` `2.1.2` `2.1.3` `2.1.4`

org.webjars.npm:jquery Maven

All org.webjars.npm:jquery advisories →

Affected	Fixed in
`1.2.1` to before 1.9.0	`1.9.0`Advisories →
Also listed as affected (4) `1.7.2` `1.7.3` `1.8.2` `1.8.3`

Description

Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 1.9.0 or later.