CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability
Impact Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Patches This problem is patched in jQuery 3.5.0.
Workarounds To workaround this issue without upgrading, use DOMPurify with its SAFEFORJQUERY option to sanitize the HTML string before passing it to a jQuery method.
References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.
Other sources
A flaw was found in jQuery. HTML containing \<option\> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
— F5
JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
— CISA
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2020:4211
- RHSA-2020:3369
- RHSA-2021:0778
- RHSA-2021:0860
- RHSA-2022:7343
- RHSA-2020:4847
- RHSA-2021:1846
- RHSA-2021:4142
- RHSA-2023:0556
- RHSA-2023:0553
- RHSA-2023:0554
- RHSA-2023:0552
- RHSA-2020:2412
- RHSA-2020:4298
- RHSA-2020:5412
- RHSA-2020:2813
- RHSA-2023:1049
- RHSA-2023:1043
- RHSA-2023:1044
- RHSA-2023:1045
- RHSA-2020:3247
- RHSA-2020:3807
- RHSA-2022:6393
- IBM-7242354
Frequently Asked Questions
What is the severity of CVE-2020-11023?
CVE-2020-11023 has a moderate severity level, allowing potential execution of untrusted code via DOM manipulation methods in jQuery.
How do I fix CVE-2020-11023?
To mitigate CVE-2020-11023, upgrade to jQuery version 3.5.0 or later.
What versions of jQuery are affected by CVE-2020-11023?
CVE-2020-11023 affects all jQuery versions prior to 3.5.0.
What components use jQuery that may be affected by CVE-2020-11023?
Components using jQuery versions less than 3.5.0 are vulnerable, including numerous web applications and libraries.
Is there a patch available for CVE-2020-11023?
Yes, the patch for CVE-2020-11023 is included in jQuery version 3.5.0.