CVE-2020-11023BIT-drupal-2020-11023GHSA-jpcq-cgw6-v4j6

JQuery Cross-Site Scripting (XSS) Vulnerability

JQuery JQuerynpmLibraries & packages

CVSS

6.9Medium

ExploitationExploited in the wildAdded to KEV 23 Jan 2025CISA KEV

Exploit odds (EPSS)84.9%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.5.0Also 4.4.0GitHub

Federal deadline13 Feb 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

3.5.0jquery, npmGitHubnpm install jquery@3.5.0
4.4.0jquery-rails, RubyGemsOSVbundle update jquery-rails --conservative # needs 4.4.0 or later
3.5.0jQuery, NuGetOSVdotnet add package jQuery --version 3.5.0
3.5.0org.webjars.npm:jquery, MavenOSV<dependency><groupId>org.webjars.npm</groupId><artifactId>jquery</artifactId><version>3.5.0</version></dependency>
3.5.0components/jquery, PackagistOSVcomposer require "components/jquery:^3.5.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

29 Apr 2020, 00:00 UTCPublishedCVE List
14 Apr 2021Exploit code publicExploit-DB
23 Jan 2025Added to CISA KEVCISA KEV

Public exploit code and templates 1

Webapps exploitjQuery 1.0.3 - Cross-Site Scripting (XSS) 14 Apr 2021Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.

Text from CVE List

Affected versions 173

jQueryaffected: >= 1.0.3, < 3.5.0CVE List
jquery, npm>=1.0.3 <3.5.0GitHub
jquery, npmfrom 1.0.3, fixed in 3.5.0OSV
jquery-rails, RubyGemsfrom first release, fixed in 4.4.0OSV
jquery-rails, RubyGems0.1.1OSV
jquery-rails, RubyGems0.1.2OSV
jquery-rails, RubyGems0.1.3OSV
jquery-rails, RubyGems0.2OSV
jquery-rails, RubyGems0.2.1OSV
jquery-rails, RubyGems0.2.2OSV
jquery-rails, RubyGems0.2.3OSV
jquery-rails, RubyGems0.2.4OSV
jquery-rails, RubyGems0.2.5OSV
jquery-rails, RubyGems0.2.6OSV
jquery-rails, RubyGems0.2.7OSV
jquery-rails, RubyGems1.0OSV
jquery-rails, RubyGems1.0.1OSV
jquery-rails, RubyGems1.0.10OSV
jquery-rails, RubyGems1.0.11OSV
jquery-rails, RubyGems1.0.12OSV
jquery-rails, RubyGems1.0.13OSV
jquery-rails, RubyGems1.0.14OSV
jquery-rails, RubyGems1.0.15OSV
jquery-rails, RubyGems1.0.16OSV
jquery-rails, RubyGems1.0.17OSV
jquery-rails, RubyGems1.0.18OSV
jquery-rails, RubyGems1.0.19OSV
jquery-rails, RubyGems1.0.2OSV
jquery-rails, RubyGems1.0.3OSV
jquery-rails, RubyGems1.0.4OSV
jquery-rails, RubyGems1.0.5OSV
jquery-rails, RubyGems1.0.6OSV
jquery-rails, RubyGems1.0.7OSV
jquery-rails, RubyGems1.0.8OSV
jquery-rails, RubyGems1.0.9OSV
jquery-rails, RubyGems1.0.rcOSV
jquery-rails, RubyGems2.0.1OSV
jquery-rails, RubyGems2.0.2OSV
jquery-rails, RubyGems2.0.3OSV
jquery-rails, RubyGems2.1.0OSV
jquery-rails, RubyGems2.1.1OSV
jquery-rails, RubyGems2.1.2OSV
jquery-rails, RubyGems2.1.3OSV
jquery-rails, RubyGems2.1.4OSV
jquery-rails, RubyGems2.2.0OSV
jquery-rails, RubyGems2.2.1OSV
jquery-rails, RubyGems2.2.2OSV
jquery-rails, RubyGems2.3.0OSV
jquery-rails, RubyGems3.0.0OSV
jquery-rails, RubyGems3.0.1OSV
jquery-rails, RubyGems3.0.2OSV
jquery-rails, RubyGems3.0.3OSV
jquery-rails, RubyGems3.0.4OSV
jquery-rails, RubyGems3.1.0OSV
jQuery, NuGetfrom 1.0.3, fixed in 3.5.0OSV
jQuery, NuGet1.10.0OSV
jQuery, NuGet1.10.0.1OSV
jQuery, NuGet1.10.1OSV
jQuery, NuGet1.10.2OSV
jQuery, NuGet1.11.0OSV
jQuery, NuGet1.11.1OSV
jQuery, NuGet1.11.2OSV
jQuery, NuGet1.11.3OSV
jQuery, NuGet1.12.0OSV
jQuery, NuGet1.12.1OSV
jQuery, NuGet1.12.2OSV
jQuery, NuGet1.12.3OSV
jQuery, NuGet1.12.4OSV
jQuery, NuGet1.4.1OSV
jQuery, NuGet1.4.2OSV
jQuery, NuGet1.4.3OSV
jQuery, NuGet1.4.4OSV
jQuery, NuGet1.5.0OSV
jQuery, NuGet1.5.1OSV
jQuery, NuGet1.5.2OSV
jQuery, NuGet1.6.0OSV
jQuery, NuGet1.6.1OSV
jQuery, NuGet1.6.2OSV
jQuery, NuGet1.6.3OSV
jQuery, NuGet1.6.4OSV
jQuery, NuGet1.7.0OSV
jQuery, NuGet1.7.1OSV
jQuery, NuGet1.7.1.1OSV
jQuery, NuGet1.7.2OSV
jQuery, NuGet1.8.0OSV
jQuery, NuGet1.8.1OSV
jQuery, NuGet1.8.2OSV
jQuery, NuGet1.8.3OSV
jQuery, NuGet1.9.0OSV
jQuery, NuGet1.9.1OSV
jQuery, NuGet2.0.0OSV
jQuery, NuGet2.0.1OSV
jQuery, NuGet2.0.1.1OSV
jQuery, NuGet2.0.2OSV
jQuery, NuGet2.0.3OSV
jQuery, NuGet2.1.0OSV
jQuery, NuGet2.1.1OSV
jQuery, NuGet2.1.2OSV
jQuery, NuGet2.1.3OSV
jQuery, NuGet2.1.4OSV
jQuery, NuGet2.2.0OSV
jQuery, NuGet2.2.1OSV
jQuery, NuGet2.2.2OSV
jQuery, NuGet2.2.3OSV
jQuery, NuGet2.2.4OSV
org.webjars.npm:jquery, Mavenfrom 1.0.3, fixed in 3.5.0OSV
org.webjars.npm:jquery, Maven1.11.0OSV
org.webjars.npm:jquery, Maven1.11.1OSV
org.webjars.npm:jquery, Maven1.11.3OSV
org.webjars.npm:jquery, Maven1.12.1OSV
org.webjars.npm:jquery, Maven1.12.2OSV
org.webjars.npm:jquery, Maven1.12.3OSV
org.webjars.npm:jquery, Maven1.12.4OSV
org.webjars.npm:jquery, Maven1.7.2OSV
org.webjars.npm:jquery, Maven1.7.3OSV
org.webjars.npm:jquery, Maven1.8.2OSV
org.webjars.npm:jquery, Maven1.8.3OSV
org.webjars.npm:jquery, Maven1.9.1OSV
org.webjars.npm:jquery, Maven2.1.0OSV
org.webjars.npm:jquery, Maven2.1.1OSV
org.webjars.npm:jquery, Maven2.1.1-rc1OSV
org.webjars.npm:jquery, Maven2.1.1-rc2OSV
org.webjars.npm:jquery, Maven2.1.3OSV
org.webjars.npm:jquery, Maven2.1.4OSV
org.webjars.npm:jquery, Maven2.2.0OSV
org.webjars.npm:jquery, Maven2.2.1OSV
org.webjars.npm:jquery, Maven2.2.2OSV
org.webjars.npm:jquery, Maven2.2.3OSV
org.webjars.npm:jquery, Maven2.2.4OSV
org.webjars.npm:jquery, Maven3.0.0OSV
org.webjars.npm:jquery, Maven3.0.0-alpha1OSV
org.webjars.npm:jquery, Maven3.0.0-beta1OSV
org.webjars.npm:jquery, Maven3.0.0-rc1OSV
org.webjars.npm:jquery, Maven3.1.0OSV
org.webjars.npm:jquery, Maven3.1.1OSV
org.webjars.npm:jquery, Maven3.2.0OSV
org.webjars.npm:jquery, Maven3.2.1OSV
org.webjars.npm:jquery, Maven3.3.0OSV
org.webjars.npm:jquery, Maven3.3.1OSV
org.webjars.npm:jquery, Maven3.4.0OSV
org.webjars.npm:jquery, Maven3.4.1OSV
components/jquery, Packagistfrom 1.0.3, fixed in 3.5.0OSV
components/jquery, Packagist1.10.0OSV
components/jquery, Packagist1.10.1OSV
components/jquery, Packagist1.10.2OSV
components/jquery, Packagist1.11.0OSV
components/jquery, Packagist1.11.1OSV
components/jquery, Packagist1.11.2OSV
components/jquery, Packagist1.11.3OSV
components/jquery, Packagist1.12.0OSV
components/jquery, Packagist1.12.1OSV
components/jquery, Packagist1.12.4OSV
components/jquery, Packagist1.8.3OSV
components/jquery, Packagist1.9.0OSV
components/jquery, Packagist1.9.1OSV
components/jquery, Packagist2.0.0OSV
components/jquery, Packagist2.0.1OSV
components/jquery, Packagist2.0.2OSV
components/jquery, Packagist2.0.3OSV
components/jquery, Packagist2.1.0OSV
components/jquery, Packagist2.1.1OSV
components/jquery, Packagist2.1.3OSV
components/jquery, Packagist2.1.4OSV
components/jquery, Packagist2.2.0OSV
components/jquery, Packagist2.2.1OSV
components/jquery, Packagist2.2.4OSV
components/jquery, Packagist3.0.0OSV
components/jquery, Packagist3.1.0OSV
components/jquery, Packagist3.1.1OSV
components/jquery, Packagist3.2.0OSV
components/jquery, Packagist3.2.1OSV
components/jquery, Packagist3.3.1OSV
components/jquery, Packagist3.4.1OSV