Description
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | datatables.net | unspecified – < 1.11.3 | 1.11.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | datatables.js | 1.10.21+dfsg-3 | — |
| Debian 13 | datatables.js | 1.10.21+dfsg-3 | — |
| Debian 12 | datatables.js | 1.10.21+dfsg-3 | — |
| Debian 10 | datatables.js | 1.10.19+dfsg-1+deb10u1 | DLA-3529-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | datatables.js | No fix yet | — |
| Ubuntu 26.04 LTS | datatables.js | No fix yet | — |
| Ubuntu 25.10 | datatables.js | No fix yet | — |
| Ubuntu 24.04 LTS | datatables.js | No fix yet | — |
| Ubuntu 22.04 LTS | datatables.js | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | datatables.js | No fix yet | — |
| Ubuntu 18.04 LTS | datatables.js | No fix yet | — |
| Ubuntu 16.04 LTS | datatables.js | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.5.8-1.redhat_00001.1.el7eap | RHSA-2024:3561, RHSA-2024:3560, RHSA-2024:3559 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.22-1.Final_redhat_00001.1.el7eap | RHSA-2024:3561, RHSA-2024:3560, RHSA-2024:3559 |
| Red Hat JBoss EAP 7 | eap7-infinispan +9 | 11.0.19-2.Final_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.54-3.Final_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 3.0.0-8.SP08_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 13.5.0-1.Final_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.12.3-3.Final_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-36.Final_redhat_00035.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.32-1.SP1_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-wildfly +5 | 7.4.17-2.GA_redhat_00002.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-wildfly-discovery +1 | 1.2.4-1.Final_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.23-2.Final_redhat_00001.1.el7eap | RHSA-2024:3561, RHSA-2024:3560, RHSA-2024:3559 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.1.17-1.Final_redhat_00002.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.19-1.Final_redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.4.3-1.redhat_00001.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.3.4-1.redhat_00002.1.el8eap | RHSA-2024:3561, RHSA-2024:3560 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | reaper | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | datatables.net | < 1.11.3 | 1.11.3 | GHSA-h73q-5wmj-q8pj |
Advisories 6
- RHSA-2024:3561 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2024:3559 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2024:3560 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DLA-3529-1 datatables.js - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-2471 IBM Spectrum Protect Plus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2024-0257 IBM QRadar SIEM User Behavior Analytics: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 1, 2024
References
- https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376
- https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b
- https://cdn.datatables.net/1.11.3/
- [debian-lts-announce] 20230815 [SECURITY] [DLA 3529-1] datatables.js security update mailing-list
- https://security.netapp.com/advisory/ntap-20240621-0006/