CVE-2020-7656: XSS
A flaw was found in jquery in versions prior to 1.9.0. A cross-site scripting attack is possible as the load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character which results in the enclosed script logic to be executed. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the load method. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 1.9.0 or later.
— GitHub
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7656?
CVE-2020-7656 is a vulnerability in jQuery that allows for Cross-site Scripting attacks via the load method.
How does CVE-2020-7656 affect jQuery?
CVE-2020-7656 affects jQuery versions prior to 1.9.0.
What is the severity of CVE-2020-7656?
The severity of CVE-2020-7656 is medium, with a severity value of 6.1.
How can I fix CVE-2020-7656?
To fix CVE-2020-7656, update jQuery to version 1.9.0 or later.
Where can I find more information about CVE-2020-7656?
You can find more information about CVE-2020-7656 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-7656), [Snyk](https://snyk.io/vuln/SNYK-JS-JQUERY-569619), [NetApp Security Advisory](https://security.netapp.com/advisory/ntap-20200528-0001/).