JQuery Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 23/01/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.webjars.npm:jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| jQuery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| components/jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| jquery-rails | < 4.4.0 | 4.4.0 |
| drupal | ≥ 7.0, < 7.70≥ 8.7.0, < 8.7.14≥ 8.8.0, < 8.8.6 | 7.708.7.148.8.6 |
| jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |
| oncommand system manager | ≥ 3.0, ≤ 3.1.3 | |
| application express | < 20.2 |
Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
This problem is patched in jQuery 3.5.0.
To workaround this issue without upgrading, use DOMPurify with its SAFE_FOR_JQUERY option to sanitize the HTML string before passing it to a jQuery method.
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free20.2 |
| application testing suite | = 13.3.0.1 |
| banking enterprise collections | ≥ 2.7.0, ≤ 2.8.0 |
| banking platform | ≥ 2.4.0, ≤ 2.10.0 |
| blockchain platform | = 21.1.2< 21.1.2 | 21.1.2 |
| business intelligence | = 5.9.0.0.0 |
| communications analytics | = 12.1.1 |
| communications eagle application processor | ≥ 16.1.0, ≤ 16.4.0 |
| communications element manager | = 8.1.1= 8.2.0= 8.2.1 |
| communications interactive session recorder | ≥ 6.1, ≤ 6.4 |
| communications operations monitor | = 3.4≥ 4.1, ≤ 4.3 |
| communications services gatekeeper | = 7.0 |
| communications session report manager | = 8.1.1= 8.2.0= 8.2.1 |
| communications session route manager | = 8.1.1= 8.2.0= 8.2.1 |
| financial services regulatory reporting for de nederlandsche bank | = 8.0.4 |
| financial services revenue management and billing analytics | = 2.7= 2.8 |
| health sciences inform | = 6.3.0 |
| healthcare translational research | = 3.2.1= 3.3.1= 3.3.2= 3.4.0 |
| hyperion financial reporting | = 11.1.2.4 |
| jd edwards enterpriseone orchestrator | < 9.2.5.0 | 9.2.5.0 |
| jd edwards enterpriseone tools | < 9.2.5.0 | 9.2.5.0 |
| oss support tools | < 2.12.41 | 2.12.41 |
| peoplesoft enterprise human capital management resources | = 9.2 |
| primavera gateway | ≥ 16.2, ≤ 16.2.11≥ 17.12.0, ≤ 17.12.7≥ 18.8.0, ≤ 18.8.9≥ 19.12.0, ≤ 19.12.4 |
| rest data services | = 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c= 19c |
| siebel mobile | ≤ 20.12 |
| storagetek acsls | = 8.5.1 |
| storagetek tape analytics sw tool | = 2.3.1 |
| webcenter sites | = 12.2.1.3.0= 12.2.1.4.0 |
| weblogic server | = 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0 |
| log correlation engine | < 6.0.9 | 6.0.9 |
| jquery | ≥ 1.0.3, < 3.5.0 | 3.5.0 |