JQuery · JQuery
The JQuery library, in versions from 1.0.3 up to but not including 3.5.0, has a cross-site scripting flaw in its DOM manipulation methods (such as .html() and .append()) when they receive HTML containing <option> elements. An attacker can cause untrusted code to execute by supplying such HTML from an untrusted source, even after it has been sanitised, provided a user interacts with the affected page.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
First seen exploited 9 months after disclosure. Public exploit code (Exploit-DB) appeared 12 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
5 packages in 5 ecosystems. Main package: jquery (npm, NuGet).
Upgrade to 3.5.0 or later
Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2015-9251, CVE-2019-11358, +1).
npm install jquery@3.5.03.5.0 or later in your .csprojThe first fix for CVE-2020-11023.
| If you run | Upgrade to |
|---|---|
| 1.0.3 up to 3.5.0 | 3.5.0 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.