jquery · jQuery
The flaw is an improper neutralization of input during web page generation in jQuery, affecting versions from 1.12.0 up to but not including 3.5.0. An attacker can get untrusted code executed by supplying HTML from an untrusted source to jQuery's DOM manipulation methods such as .html() and .append(), even when that HTML has been sanitized, and this requires a victim user to interact with the page.
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
First seen exploited 9 months after disclosure. Public exploit code (Exploit-DB) appeared 12 months after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
7 packages in 5 ecosystems. Main package: jquery (npm, NuGet).
Upgrade to 3.5.0 or later
Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2015-9251, CVE-2019-11358, +1).
npm install jquery@3.5.03.5.0 or later in your .csprojThe first fix for CVE-2020-11022.
| If you run | Upgrade to |
|---|---|
| 1.12.0 up to 3.5.0 | 3.5.0 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.