CVE-2020-11022: jQuery has a potential XSS vulnerability
- Is it exploited?
Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .
VulnCheck KEV lists it since . It cites 2 public reports, the first from .
- How likely is exploitation in the next 30 days?
- 99.2%
EPSS score, percentile 99.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 6.9 Medium
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- >= 1.12.0, < 3.5.0
Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
jQuery has a potential XSS vulnerability
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (1 product)
| Status | Versions |
|---|---|
| Affected | >= 1.12.0, < 3.5.0 |
Source: CVE List, as of . About the data.
Weakness
CWE-79
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
47
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://github.com/maximebf/php-debugbar/issues/447
- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77
- https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html
- https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html
- https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html
- https://security.gentoo.org/glsa/202007-03
- https://www.debian.org/security/2020/dsa-4693
- https://www.drupal.org/sa-core-2020-002
35 more in the CVE record.
Known exploited JQuery vulnerabilities
- CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability