VULNERABILITY INTELLIGENCE
CVE-2020-11022
CVSS score6.9 MEDIUM
EPSS probability99.22%
CISA KEVNot currently listed
Published2020-04-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Description
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Weakness classification
- security-advisories@github.com: CWE-79
- nvd@nist.gov: CWE-79
Primary references
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com
- security-advisories@github.com — Mitigation, Third Party Advisory
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com