jQuery vulnerable to Cross-Site Scripting (XSS)

MEDIUM 4.3CVE-2011-4969 · GHSA-579v-mp3v-rrw5 · Published 08/03/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
org.webjars.npm:jquery Maven	`< 1.6.3`	`1.6.3`
jQuery NuGet	`< 1.6.3`	`1.6.3`
jquery-rails RubyGems	`< 1.0.16`	`1.0.16`
jquery jquery	`= 1.6= 1.6.1≤ 1.6.2`	No fix yet
jquery npm	`< 1.6.3`	`1.6.3`

Description

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

NVD description

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

References

nvd.nist.gov/vuln/detail/CVE-2011-4969 · ADVISORY
jquery/jquery commit db9e023 · WEB
jquery/jquery · PACKAGE
rubysec/ruby-advisory-db · WEB
lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E · WEB
security.netapp.com/advisory/ntap-20190416-0007 · WEB
security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450224 · WEB
blog.jquery.com/2011/09/01/jquery-1-6-3-released · WEB
blog.mindedsecurity.com/2011/07/jquery-is-sink.html · WEB
bugs.jquery.com/ticket/9521 · WEB
openwall.com/lists/oss-security/2013/01/31/3 · WEB
ubuntu.com/usn/USN-1722-1 · WEB
blog.jquery.com/2011/09/01/jquery-1-6-3-released
osvdb.org/80056
securityfocus.com/bid/58458
securitytracker.com/id/1036620
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay
lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
security.netapp.com/advisory/ntap-20190416-0007

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free