Vulnerability advisory

GHSA-rmxg-73gg-4p98

Cross-Site Scripting (XSS) in jquery

Published Jan 22, 2018Updated Mar 10, 2024OSV record ↗

Also known as CVE-2015-9251

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

jquery npm

All jquery advisories →

Affected	Fixed in
All versions before 1.12.2	`1.12.2`Advisories →

jQuery NuGet

All jQuery advisories →

Affected	Fixed in
All versions before 1.12.2	`1.12.2`Advisories →
Also listed as affected (32) `1.10.0` `1.10.0.1` `1.10.1` `1.10.2` `1.11.0` `1.11.1` `1.11.2` `1.11.3` `1.12.0` `1.12.1` `1.4.1` `1.4.2` `1.4.3` `1.4.4` `1.5.0` `1.5.1` `1.5.2` `1.6.0` `1.6.1` `1.6.2` `1.6.3` `1.6.4` `1.7.0` `1.7.1` `1.7.1.1` `1.7.2` `1.8.0` `1.8.1` `1.8.2` `1.8.3` `1.9.0` `1.9.1`
`1.12.3` to before 3.0.0	`3.0.0`Advisories →
Also listed as affected (17) `1.12.3` `1.12.4` `2.0.0` `2.0.1` `2.0.1.1` `2.0.2` `2.0.3` `2.1.0` `2.1.1` `2.1.2` `2.1.3` `2.1.4` `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4`

jquery npm

All jquery advisories →

Affected	Fixed in
`1.12.3` to before 3.0.0	`3.0.0`Advisories →

jquery-rails RubyGems

All jquery-rails advisories →

Affected Fixed in

All versions before 4.2.0 4.2.0Advisories →

Affected	Fixed in
All versions before 4.2.0	`4.2.0`Advisories →
Also listed as affected (65) `0.1.1` `0.1.2` `0.1.3` `0.2` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.2.5` `0.2.6` `0.2.7` `1.0` `1.0.1` `1.0.10` `1.0.11` `1.0.12` `1.0.13` `1.0.14` `1.0.15` `1.0.16` `1.0.17` `1.0.18` `1.0.19` `1.0.2` `1.0.3` `1.0.4` `1.0.5` `1.0.6` `1.0.7` `1.0.8` `1.0.9` `1.0.rc` `2.0.1` `2.0.2` `2.0.3` `2.1.0` `2.1.1` `2.1.2` `2.1.3` `2.1.4` `2.2.0` `2.2.1` `2.2.2` `2.3.0` `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.0.4` `3.1.0` `3.1.1` `3.1.2` `3.1.3` `3.1.4` `3.1.5` `4.0.0` `4.0.0.beta1` `4.0.0.beta2` `4.0.1` `4.0.2` `4.0.3` `4.0.4` `4.0.5` `4.1.0` `4.1.1`

Also listed as affected (65)

org.webjars.npm:jquery Maven

All org.webjars.npm:jquery advisories →

Affected	Fixed in
All versions before 1.12.2	`1.12.2`Advisories →
Also listed as affected (9) `1.11.0` `1.11.1` `1.11.3` `1.12.1` `1.7.2` `1.7.3` `1.8.2` `1.8.3` `1.9.1`
`1.12.3` to before 3.0.0	`3.0.0`Advisories →
Also listed as affected (16) `1.12.3` `1.12.4` `2.1.0` `2.1.1` `2.1.1-rc1` `2.1.1-rc2` `2.1.3` `2.1.4` `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `3.0.0-alpha1` `3.0.0-beta1` `3.0.0-rc1`

Description

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option.

Recommendation

Update to version 3.0.0 or later.

GHSA-rmxg-73gg-4p98

Affected versions

jquery npm

jQuery NuGet

jquery npm

jquery-rails RubyGems

org.webjars.npm:jquery Maven

Description

Recommendation

References