GHSA-gxr4-xjj5-5px2

Suggest an improvement
Source
https://github.com/advisories/GHSA-gxr4-xjj5-5px2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/04/GHSA-gxr4-xjj5-5px2/GHSA-gxr4-xjj5-5px2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gxr4-xjj5-5px2
Aliases
Published
2020-04-29T22:18:55Z
Modified
2024-03-12T05:17:58.993889Z
Severity
  • 6.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Potential XSS vulnerability in jQuery
Details

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

This problem is patched in jQuery 3.5.0.

Workarounds

To workaround the issue without upgrading, adding the following to your code:

jQuery.htmlPrefilter = function( html ) {
    return html;
};

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

References

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.

References

Affected packages

npm / jquery

Package

Name
jquery
View open source insights on deps.dev
Purl
pkg:npm/jquery

Affected ranges

Type
SEMVER
Events
Introduced
1.2.0
Fixed
3.5.0

NuGet / jquery

Package

Name
jquery
View open source insights on deps.dev
Purl
pkg:nuget/jquery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.2.0
Fixed
3.5.0

Affected versions

1.*

1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.7.0
1.7.1
1.7.1.1
1.7.2
1.8.0
1.8.1
1.8.2
1.8.3
1.9.0
1.9.1
1.10.0
1.10.0.1
1.10.1
1.10.2
1.11.0
1.11.1
1.11.2
1.11.3
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4

2.*

2.0.0
2.0.1
2.0.1.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4

3.*

3.0.0
3.0.0.1
3.1.0
3.1.1
3.2.1
3.3.1
3.4.0
3.4.1

RubyGems / jquery-rails

Package

Name
jquery-rails
Purl
pkg:gem/jquery-rails

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.4.0

Affected versions

0.*

0.1.1
0.1.2
0.1.3
0.2
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7

1.*

1.0.rc
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.19

2.*

2.0.1
2.0.2
2.0.3
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.3.0

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5

4.*

4.0.0.beta1
4.0.0.beta2
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.1.0
4.1.1
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5

Maven / org.webjars.npm:jquery

Package

Name
org.webjars.npm:jquery
View open source insights on deps.dev
Purl
pkg:maven/org.webjars.npm/jquery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.2.0
Fixed
3.5.0

Affected versions

1.*

1.7.2
1.7.3
1.8.2
1.8.3
1.9.1
1.11.0
1.11.1
1.11.3
1.12.1
1.12.2
1.12.3
1.12.4

2.*

2.1.0
2.1.1-rc1
2.1.1-rc2
2.1.1
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4

3.*

3.0.0-alpha1
3.0.0-beta1
3.0.0-rc1
3.0.0
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1