VULNERABILITY INTELLIGENCE
CVE-2020-11023
CVSS score6.9 MEDIUM
EPSS probability84.89%
CISA KEVKnown exploited vulnerability
Published2020-04-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Known Exploited Vulnerability
JQuery Cross-Site Scripting (XSS) Vulnerability
Vendor / product: JQuery / JQuery
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Weakness classification
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Primary references
- security-advisories@github.com — Broken Link
- security-advisories@github.com — Broken Link
- security-advisories@github.com — Broken Link, Mailing List, Third Party Advisory
- security-advisories@github.com — Exploit, Third Party Advisory, VDB Entry
- security-advisories@github.com — Release Notes, Vendor Advisory
- security-advisories@github.com — Third Party Advisory
- security-advisories@github.com — Release Notes, Vendor Advisory
- security-advisories@github.com — Issue Tracking, Mailing List
- security-advisories@github.com — Issue Tracking, Mailing List
- security-advisories@github.com — Issue Tracking, Mailing List
- security-advisories@github.com — Issue Tracking, Mailing List
- security-advisories@github.com — Issue Tracking, Mailing List