Summary
It was discovered that jQuery incorrectly handled parsing untrusted HTML. A
remote attacker could possibly use this issue to execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | jquery | 3.3.1~dfsg-3ubuntu0.1 |
Vulnerabilities 2
-
Medium 6.9
Potential XSS vulnerability in jQuery
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…
KEV Jan 23, 2025 -
Medium 6.9
jQuery has a potential XSS vulnerability
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…