Vulnerability advisory

PYSEC-2026-628

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Published Jul 2, 2026Updated Jul 6, 2026OSV record ↗

Also known as CVE-2019-11358DRUPAL-CORE-2019-006GHSA-6c3j-c64m-qhgq

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`2.0a1` to before 2.1.9	`2.1.9`Advisories →
`2.2a1` to before 2.2.2	`2.2.2`Advisories →
Also listed as affected (32) `2.0` `2.0.1` `2.0.10` `2.0.12` `2.0.13` `2.0.2` `2.0.3` `2.0.4` `2.0.5` `2.0.6` `2.0.7` `2.0.8` `2.0.9` `2.0a1` `2.0b1` `2.0rc1` `2.1` `2.1.1` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.7` `2.1.8` `2.1a1` `2.1b1` `2.1rc1` `2.2` `2.2.1` `2.2a1` `2.2b1` `2.2rc1`

Description

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

PYSEC-2026-628

Affected versions

django PyPI

Description

References