GitHub Advisoryadvisory · npm, NuGet, RubyGems, Maven

GHSA-q4m3-2j7h-f7xw Cross-Site Scripting in jquery

MEDIUM Published 2020-05-20 Modified 2024-10-10 Official page ↗
Aliases
CVE-2020-7656
Ecosystem
npm, NuGet, RubyGems, Maven
Packages
jquery, jQuery, jquery-rails, org.webjars.npm:jquery
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-05-20

Affected packages

• npm jquery: >= 1.2.1, < 1.9.0 → fixed in 1.9.0 • NuGet jQuery: >= 1.2.1, < 1.9.0 → fixed in 1.9.0 • RubyGems jquery-rails: < 2.2.0 → fixed in 2.2.0 • Maven org.webjars.npm:jquery: >= 1.2.1, < 1.9.0 → fixed in 1.9.0

Description

Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove `` HTML tags that contain a whitespace character, i.e: ``, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 1.9.0 or later.

Related

Alias · CVE (1)

  • CVE-2020-7656 jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References