Skip to content
Fencer Intel
medium 6.9

CVE-2020-11023 kev in the critical feed json

Potential XSS vulnerability in jQuery

published 6y ago modified last mo. also BIT-drupal-2020-11023 , EUVD-2020-0387 , GHSA-jpcq-cgw6-v4j6

cvss
6.9
version 3.1, CNA
cisa kev
Exploited
added 2025-01-23
epss
84.9%
EPSS 84.9% chance of exploitation in 30 days, percentile 99.7%
public exploits
1
Exploit-DB

Summary

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  • npm jquery 3.5.0
  • rubygems jquery-rails 4.4.0
  • nuget jQuery 3.5.0
  • maven org.webjars.npm:jquery 3.5.0
  • packagist components/jquery 3.5.0
  • bitnami drupal 7.70.0, 8.7.14, 8.8.6
  • jquery jquery 3.5.0
  • drupal drupal 7.70, 8.7.14, 8.8.6
  • oracle application_express 20.2
  • oracle blockchain_platform 21.1.2
  • oracle jd_edwards_enterpriseone_orchestrator 9.2.5.0
  • oracle jd_edwards_enterpriseone_tools 9.2.5.0
  • oracle oss_support_tools 2.12.41
  • tenable log_correlation_engine 6.0.9
  • znc Debian 14 1.10.3-1
  • node-jquery Debian 14, Debian 13, Debian 12 3.5.0+dfsg-2

debian advisories DEBIAN-CVE-2020-11023

  • jquery Ubuntu 20.04 LTS 3.3.1~dfsg-3ubuntu0.1
  • jquery Ubuntu Pro 18.04 LTS 3.2.1-1ubuntu0.1~esm1
  • drupal7 Ubuntu Pro 14.04 LTS 7.26-1ubuntu0.1+esm3
  • drupal7 Ubuntu Pro 16.04 LTS 7.44-1ubuntu1~16.04.0+esm3

ubuntu advisories UBUNTU-CVE-2020-11023

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • gcc RHEL 9 11.5.0-5.el9_5
  • cpp RHEL 9 11.5.0-5.el9_5
  • libgcc RHEL 9 11.5.0-5.el9_5
  • libitm RHEL 9 11.5.0-5.el9_5
  • gcc-c++ RHEL 9 11.5.0-5.el9_5
  • libasan RHEL 9 11.5.0-5.el9_5
  • libgomp RHEL 9 11.5.0-5.el9_5
  • liblsan RHEL 9 11.5.0-5.el9_5

red hat advisories RHSA-2025:2426RHSA-2025:1601RHSA-2025:1580RHSA-2025:1515RHSA-2025:1514RHSA-2025:1346

  • otrs Package Hub 15 SP2, Package Hub 15 SP1, openSUSE Leap 15.2 +1 more 6.0.30-bp152.2.11.1
  • cacti-spine Package Hub 15 SP1 1.2.13-bp151.4.12.1
  • cacti Package Hub 15 SP1 1.2.13-bp151.4.12.1
  • cacti-spine Package Hub 12, openSUSE Leap 15.2, openSUSE Leap 15.1 1.2.13-8.1
  • cacti Package Hub 12, openSUSE Leap 15.2, openSUSE Leap 15.1 1.2.13-11.1

opensuse advisories openSUSE-SU-2020:1888-1openSUSE-SU-2020:1106-1openSUSE-SU-2020:1060-1

  • gcc-toolset-14-gcc AlmaLinux 8 14.2.1-7.1.el8_10
  • liblsan AlmaLinux 8 14.2.1-7.1.el8_10
  • libasan8 AlmaLinux 8 14.2.1-7.1.el8_10
  • libtsan2 AlmaLinux 8 14.2.1-7.1.el8_10
  • gcc-toolset-14-gcc-c++ AlmaLinux 8 14.2.1-7.1.el8_10
  • gcc-toolset-14-libgccjit AlmaLinux 8 14.2.1-7.1.el8_10
  • gcc-toolset-14-gcc-gfortran AlmaLinux 8 14.2.1-7.1.el8_10
  • gcc-toolset-14-offload-nvptx AlmaLinux 8 14.2.1-7.1.el8_10

almalinux advisories ALSA-2025:1338ALSA-2025:1346ALSA-2025:1300ALSA-2025:1301ALSA-2025:1306ALSA-2025:1309

  • tbb Rocky Linux 9 2020.3-8.el9_5.1
  • gcc-toolset-14-gcc Rocky Linux 9 14.2.1-1.3.el9_5
  • gcc-toolset-13-gcc Rocky Linux 9 13.3.1-2.2.el9_5
  • doxygen Rocky Linux 9 1:1.9.1-12.el9_5
  • gcc Rocky Linux 9 11.5.0-5.el9_5
  • doxygen Rocky Linux 8 1:1.8.14-13.el8_10
  • tbb Rocky Linux 8 2018.2-10.el8_10.1
  • gcc-toolset-13-gcc Rocky Linux 8 13.3.1-2.2.el8_10

rocky linux advisories RLSA-2025:1210RLSA-2025:1300RLSA-2025:1309RLSA-2025:1329RLSA-2025:1346RLSA-2025:1314

  • cacti Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.2.13-r0
  • drupal7 Alpine 3.20, Alpine 3.19, Alpine 3.18 +7 more 7.70-r0

alpine advisories ALPINE-CVE-2020-11023

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2020-11023 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-11023 updated cvss 6.1

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

  • Red Hat CloudForms Management Engine 5 cfme-gemset Red Hat Ceph Storage 3 grafana, grafana-container Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 6 cpp, gcc, ipa, pcp, pcs, libgcc, +110 more Red Hat Enterprise Linux 7 publican, publican-common-web, publican-common-db5-web Red Hat Fuse 7 io.hawt-project, python-sphinxcontrib-jquery, konflux-ci/integration-service, io.apicurio-apicurito io.apicurio-apicurito, io.hawt-hawtio-online io.hawt-hawtio-online, io.syndesis-syndesis-ui io.syndesis-syndesis-ui, +1 more
    +6 more products
    Red Hat JBoss Data Grid 7 jquery, org.jboss.hal-hal-parent, container-native-virtualization/kubevirt-console-plugin Red Hat OpenShift Container Platform 3.11 openshift3/grafana Red Hat OpenStack Platform 15 (Stein) python-XStatic-jQuery, python3-XStatic-jQuery Red Hat Software Collections python27-python-coverage, python27-python-werkzeug, rh-python35-python-coverage, rh-python36-python-coverage, rh-ror42-rubygem-jquery-rails, rh-ror50-rubygem-jquery-rails Red Hat Storage 3 pcs, grafana, python-django, python2-django, python-testtools, python-django-bash-completion Red Hat Virtualization 4 rhvm, ovirt-engine, ovirt-engine-setup, ovirt-engine-tools, ovirt-engine-backend, ovirt-engine-restapi, +15 more
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-1, discovery/discovery-server-rhel9 1.12.0-1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1249
  • Red Hat OpenShift Service Mesh 1.1 ior 1.1.6-1.el8, servicemesh 1.1.6-1.el8, servicemesh-cni 1.1.6-1.el8, servicemesh-mixc 1.1.6-1.el8, servicemesh-mixs 1.1.6-1.el8, servicemesh-galley 1.1.6-1.el8, +9 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2020:3369
  • Red Hat Quay v3 quay/quay-rhel8 v3.10.9-2, quay/quay-rhel8 v3.11.9-5, quay/quay-rhel8 v3.12.8-2, quay/quay-rhel8 v3.13.4-6, quay/quay-rhel8 v3.9.10-7, quay/clair-rhel8 v3.10.9-1, +44 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHBA-2025:1079
  • Red Hat AMQ Interconnect 1 qpid-dispatch 1.13.0-3.el7, qpid-dispatch 1.13.0-3.el8, qpid-dispatch 1.13.0-3.el6_10, qpid-dispatch-tools 1.13.0-3.el7, qpid-dispatch-tools 1.13.0-3.el8, qpid-dispatch-router 1.13.0-3.el7, +6 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2020:4211
  • Red Hat Ansible Tower 3.6 for RHEL 7 ansible-tower-36/ansible-tower 3.6.7-1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:0778
  • Red Hat Ansible Tower 3.7 for RHEL 7 ansible-tower-37/ansible-tower-rhel7 3.7.4-1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2020:5249
  • Red Hat build of Keycloak 26.2 rhbk/keycloak-rhel9 26.2-3, rhbk/keycloak-rhel9-operator 26.2-3, rhbk/keycloak-operator-bundle 26.2.4-2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHBA-2025:7639
show 21 more
  • Red Hat CodeReady Linux Builder (v. 9) doxygen 1.9.1-12.el9_5, doxygen-latex 1.9.1-12.el9_5, doxygen-doxywizard 1.9.1-12.el9_5
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1346
  • Red Hat CodeReady Linux Builder EUS (v.8.8) doxygen 1.8.14-13.el8_8, doxygen-latex 1.8.14-13.el8_8, doxygen-doxywizard 1.8.14-13.el8_8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1311
  • Red Hat CodeReady Linux Builder EUS (v.9.2) doxygen 1.9.1-12.el9_2, doxygen-latex 1.9.1-12.el9_2, doxygen-doxywizard 1.9.1-12.el9_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1303
  • Red Hat CodeReady Linux Builder EUS (v.9.4) doxygen 1.9.1-12.el9_4, doxygen-latex 1.9.1-12.el9_4, doxygen-doxywizard 1.9.1-12.el9_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1304
  • Red Hat Enterprise Linux AppStream (v. 8) cpp 8.5.0-23.el8_10, gcc 8.5.0-23.el8_10, tbb 2018.2-10.el8_10.1, gcc-c++ 8.5.0-23.el8_10, liblsan 13.3.1-2.2.el8_10, liblsan 14.2.1-7.1.el8_10, +127 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1301
  • Red Hat Enterprise Linux AppStream (v. 9) cpp 11.5.0-5.el9_5, gcc 11.5.0-5.el9_5, tbb 2020.3-8.el9_5.1, libitm 11.5.0-5.el9_5, gcc-c++ 11.5.0-5.el9_5, libasan 11.5.0-5.el9_5, +27 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1346
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) cpp 8.3.1-8.el8_2, gcc 8.3.1-8.el8_2, tbb 2018.2-9.el8_2.1, gcc-c++ 8.3.1-8.el8_2, gcc-gfortran 8.3.1-8.el8_2, gcc-gdb-plugin 8.3.1-8.el8_2, +36 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1515
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) cpp 8.4.1-1.4.el8_4, gcc 8.4.1-1.4.el8_4, tbb 2018.2-10.el8_4.1, gcc-c++ 8.4.1-1.4.el8_4, gcc-gfortran 8.4.1-1.4.el8_4, python3-tbb 2018.2-10.el8_4.1, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1312
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) cpp 8.5.0-10.4.el8_6, gcc 8.5.0-10.4.el8_6, tbb 2018.2-10.el8_6.1, gcc-c++ 8.5.0-10.4.el8_6, gcc-gfortran 8.5.0-10.4.el8_6, python3-tbb 2018.2-10.el8_6.1, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1308
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) cpp 8.4.1-1.4.el8_4, gcc 8.4.1-1.4.el8_4, tbb 2018.2-10.el8_4.1, gcc-c++ 8.4.1-1.4.el8_4, gcc-gfortran 8.4.1-1.4.el8_4, python3-tbb 2018.2-10.el8_4.1, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1312
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) cpp 8.5.0-10.4.el8_6, gcc 8.5.0-10.4.el8_6, tbb 2018.2-10.el8_6.1, gcc-c++ 8.5.0-10.4.el8_6, gcc-gfortran 8.5.0-10.4.el8_6, python3-tbb 2018.2-10.el8_6.1, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1308
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) cpp 11.2.1-9.5.el9_0, gcc 11.2.1-9.5.el9_0, tbb 2020.3-8.el9_0.1, libitm 11.2.1-9.5.el9_0, gcc-c++ 11.2.1-9.5.el9_0, libasan 11.2.1-9.5.el9_0, +9 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1305
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) cpp 8.5.0-18.3.el8_8, gcc 8.5.0-18.3.el8_8, tbb 2018.2-10.el8_8.1, gcc-c++ 8.5.0-18.3.el8_8, gcc-gfortran 8.5.0-18.3.el8_8, python3-tbb 2018.2-10.el8_8.1, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1311
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) cpp 11.3.1-4.4.el9_2, gcc 11.3.1-4.4.el9_2, tbb 2020.3-8.el9_2.1, libitm 11.3.1-4.4.el9_2, gcc-c++ 11.3.1-4.4.el9_2, libasan 11.3.1-4.4.el9_2, +9 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1303
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) cpp 11.4.1-4.el9_4, gcc 11.4.1-4.el9_4, tbb 2020.3-8.el9_4.1, libitm 11.4.1-4.el9_4, gcc-c++ 11.4.1-4.el9_4, libasan 11.4.1-4.el9_4, +18 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1304
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) cpp 8.4.1-1.4.el8_4, gcc 8.4.1-1.4.el8_4, tbb 2018.2-10.el8_4.1, gcc-c++ 8.4.1-1.4.el8_4, gcc-gfortran 8.4.1-1.4.el8_4, python3-tbb 2018.2-10.el8_4.1, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1312
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) cpp 8.5.0-10.4.el8_6, gcc 8.5.0-10.4.el8_6, tbb 2018.2-10.el8_6.1, gcc-c++ 8.5.0-10.4.el8_6, gcc-gfortran 8.5.0-10.4.el8_6, python3-tbb 2018.2-10.el8_6.1, +2 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1308
  • Red Hat Enterprise Linux BaseOS (v. 8) gcc 8.5.0-23.el8_10, libgcc 8.5.0-23.el8_10, libitm 8.5.0-23.el8_10, libasan 8.5.0-23.el8_10, libgomp 8.5.0-23.el8_10, liblsan 8.5.0-23.el8_10, +7 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1301
  • Red Hat Enterprise Linux BaseOS (v. 9) gcc 11.5.0-5.el9_5, libgcc 11.5.0-5.el9_5, libgomp 11.5.0-5.el9_5, libatomic 11.5.0-5.el9_5, libstdc++ 11.5.0-5.el9_5, libgfortran 11.5.0-5.el9_5, +1 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1346
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) gcc 8.3.1-8.el8_2, libgcc 8.3.1-8.el8_2, libitm 8.3.1-8.el8_2, libasan 8.3.1-8.el8_2, libgomp 8.3.1-8.el8_2, liblsan 8.3.1-8.el8_2, +7 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1310
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) gcc 8.4.1-1.4.el8_4, libgcc 8.4.1-1.4.el8_4, libitm 8.4.1-1.4.el8_4, libasan 8.4.1-1.4.el8_4, libgomp 8.4.1-1.4.el8_4, liblsan 8.4.1-1.4.el8_4, +7 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1312

41 more fixed, 32 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-076-01 updated cvss 6.9

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-203-05 updated cvss 6.9

Schneider Electric System Monitor Application

  • Schneider Electric Harmony Industrial PC System Monitor application
    affected: vendor fix, mitigation se.com
  • Schneider Electric Pro-face Industrial PC System Monitor application
    affected: vendor fix, mitigation proface.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-097-01 updated cvss 6.1

Pepperl+Fuchs WirelessHART-Gateway

  • Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH 3.0.7, 3.0.8, 3.0.9 Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH.EIP 3.0.7, 3.0.8, 3.0.9
    affected: mitigation “Minimize network exposure for affected products and ensure they are not accessible via the Internet.” cert.vde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-306-01 updated cvss 6.1

Sensormatic Electronics VideoEdge

  • Sensormatic Electronics, LLC, Johnson Controls Inc. VideoEdge < 5.7.1
    affected: vendor fix, mitigation “For more detailed mitigation and product upgrade instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2021-17 v1” johnsoncontrols.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. Published
  2. First public exploit (EDB-49767)
  3. Added to CISA KEV
  4. CISA SSVC: exploitation active
  5. CISA patch deadline

Known exploited

Added
last yr.
Patch by
2025-02-13 (last yr.)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product
JQuery, JQuery
CISA name
JQuery Cross-Site Scripting (XSS) Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

84.89% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-49767 jQuery 1.0.3 - Cross-Site Scripting (XSS) webapps, 2021-04-14
  • packetstormsecurity.com http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
GitHub 3.1 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm jquery
>=1.0.3, <3.5.0
3.5.0
rubygems jquery-rails
<4.4.0
4.4.0
nuget jQuery
>=1.0.3, <3.5.0
3.5.0
maven org.webjars.npm:jquery
>=1.0.3, <3.5.0
3.5.0
packagist components/jquery
>=1.0.3, <3.5.0
3.5.0
bitnami drupal
>=7.0.0, <7.70.0
>=8.7.0, <8.7.14
>=8.8.0, <8.8.6
7.70.0
8.7.14
8.8.6

Affected products

  • jquery jQuery

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.