Description
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | jquery | 3.2.1-1ubuntu0.1~esm1 | USN-7622-1 |
| Ubuntu Pro 16.04 LTS | jquery | 1.11.3+dfsg-4ubuntu0.1~esm1 | USN-7622-1 |
| Ubuntu Pro 14.04 LTS | jquery | 1.7.2+dfsg-2ubuntu1+esm1 | USN-7622-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
| SLES 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
| SLE HPC 15 | ruby2.5 | 2.5.7-4.8.1 | SUSE-SU-2020:0737-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | ruby2.5 | 2.5.7-lp151.4.6.1 | openSUSE-SU-2020:0395-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.10 | ruby | 2.5.6-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph | 18.2.2-1 | — |
| Azure Linux 3 | python-blinker | 1.7.0-4 | — |
| Azure Linux 3 | python-httplib2 | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | python-httplib2 | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Linksys EA7500 2.0.8.194281 - Cross-Site Scripting EDB-49708 · webapps · Mar 25, 2021
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars.npm:jquery | < 1.9.0 | 1.9.0 | GHSA-2pqj-h3vj-pqgw |
| npm | jquery | < 1.9.0 | 1.9.0 | GHSA-2pqj-h3vj-pqgw |
| NuGet | jQuery | < 1.9.0 | 1.9.0 | GHSA-2pqj-h3vj-pqgw |
| RubyGems | jquery-rails | < 2.2.0 | 2.2.0 | GHSA-2pqj-h3vj-pqgw |
Advisories 9
- WID-SEC-2026-3721 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- WID-SEC-2026-3720 IBM Business Process Manager: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Oct 4, 2026
- USN-7622-1 jquery vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2026-1752 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 31, 2026
- openSUSE-SU-2020:0395-1 Recommended update for ruby2.5 SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2021-027 Pepperl+Fuchs: WirelessHART-Gateway - Vulnerability may allow remote attackers to cause a Denial Of Service CERT@VDE · May 14, 2025
- VDE-2025-024 Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version CERT@VDE · May 13, 2025
- SUSE-SU-2020:0737-1 Recommended update for ruby2.5 SUSE / openSUSE Security Updates · May 2, 2025
- ICSA-22-097-01 Pepperl+Fuchs WirelessHART-Gateway CISA ICS & IT advisories · Apr 7, 2022
References
- https://snyk.io/vuln/npm:jquery:20120206
- https://bugs.jquery.com/ticket/11290
- https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
- 102792 vdb-entry
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- openSUSE-SU-2020:0395 vendor-advisory
- http://packetstormsecurity.com/files/161972/Linksys-EA7500-2.0.8.194281-Cross-Site-Scripting.html