Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpwY3EtY2d3Ni12NGo2

Potential XSS vulnerability in jQuery

Impact

Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

This problem is patched in jQuery 3.5.0.

Workarounds

To workaround this issue without upgrading, use DOMPurify with its SAFE_FOR_JQUERY option to sanitize the HTML string before passing it to a jQuery method.

References

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.

Permalink: https://github.com/advisories/GHSA-jpcq-cgw6-v4j6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpwY3EtY2d3Ni12NGo2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 4 years ago
Updated: 8 months ago

CVSS Score: 6.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS Percentage: 0.04348
EPSS Percentile: 0.92257

Identifiers: GHSA-jpcq-cgw6-v4j6, CVE-2020-11023
References:

Repository: https://github.com/jquery/jquery
Blast Radius: 118.7

Affected Packages

npm:jquery

Dependent packages: 28,173
Dependent repositories: 998,742
Downloads: 44,672,383 last month
Affected Version Ranges: >= 1.0.3, < 3.5.0
Fixed in: 3.5.0
All affected versions: 1.5.1, 1.6.2, 1.6.3, 1.7.2, 1.7.3, 1.8.2, 1.8.3, 1.9.1, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 3.0.0, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.4.1
All unaffected versions: 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.7.0, 3.7.1

maven:org.webjars.npm:jquery

Dependent packages: 459
Dependent repositories: 216
Downloads:
Affected Version Ranges: >= 1.0.3, < 3.5.0
Fixed in: 3.5.0
All affected versions: 1.7.2, 1.7.3, 1.8.2, 1.8.3, 1.9.1, 1.11.0, 1.11.1, 1.11.3, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 2.1.0, 2.1.1, 2.1.3, 2.1.4, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 3.0.0, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.4.0, 3.4.1
All unaffected versions: 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.7.0, 3.7.1

nuget:jQuery

Dependent packages: 290
Dependent repositories: 1,276
Downloads: 203,497,424 total
Affected Version Ranges: >= 1.0.3, < 3.5.0
Fixed in: 3.5.0
All affected versions: 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.7.0, 1.7.1, 1.7.2, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.9.0, 1.9.1, 1.10.0, 1.10.1, 1.10.2, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 3.0.0, 3.1.0, 3.1.1, 3.2.1, 3.3.1, 3.4.0, 3.4.1
All unaffected versions: 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.6.3, 3.6.4, 3.7.0, 3.7.1

rubygems:jquery-rails

Dependent packages: 1,568
Dependent repositories: 576,659
Downloads: 259,940,730 total
Affected Version Ranges: < 4.4.0
Fixed in: 4.4.0
All affected versions: 0.1.1, 0.1.2, 0.1.3, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5
All unaffected versions: 4.4.0, 4.5.0, 4.5.1, 4.6.0