jQuery Remote Cross-Site Scripting (XSS) Vulnerability via DOM Manipulation Methods (CVE-2020-11023)
Executive & SecOps Summary
SECOPS ASSESSMENTjQuery versions greater than or equal to 1.0.3 and before 3.5.0
Passing untrusted HTML to jQuery's DOM manipulation methods (e.g., .html(), .append()) can execute arbitrary JavaScript code even after sanitization
Upgrade jQuery to the patched version 3.5.0 or higher, or apply a workaround to bypass the vulnerable htmlPrefilter function
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade jQuery to version 3.5.0 or later.
# For npm-managed projects
npm install jquery@3.5.0 --save
# For yarn-managed projects
yarn upgrade jquery@3.5.02. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, you can override the vulnerable jQuery.htmlPrefilter function to return the input HTML unmodified, bypassing the buggy parsing logic.
// Apply this script immediately after jQuery is loaded
if (typeof jQuery !== 'undefined' && jQuery.fn) {
jQuery.htmlPrefilter = function(html) {
return html;
};
}3. Log Audit & IoC Verification Commands
Use the following commands to scan your codebase and dependencies for vulnerable jQuery versions.
# Scan npm dependencies for vulnerable jQuery versions
npm list jquery 2>/dev/null | grep -E 'jquery@[1-2]\.|jquery@3\.[0-4]\.'
# Search for vulnerable jQuery references in source files
grep -rnI 'jquery' ./src/ | grep -E '1\.[0-9]+\.[0-9]+|2\.[0-9]+\.[0-9]+|3\.[0-4]\.[0-9]+'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability resides in jQuery's internal HTML parsing logic used during DOM manipulation. When methods like .html() or .append() are called, jQuery processes the input HTML string through an internal pre-filter (jQuery.htmlPrefilter) to ensure cross-browser compatibility. Due to flaws in this regex-based transformation, certain nested HTML structures bypass sanitizers and are parsed into executable scripts by the browser.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a payload utilizing specific HTML elements (such as <option> tags containing nested elements) that are deemed safe by standard sanitization libraries. When this sanitized input is passed to a vulnerable jQuery DOM method, jQuery's internal parser incorrectly restructures the tags. This restructuring causes the browser to interpret and execute the hidden malicious script, leading to DOM-based Cross-Site Scripting (XSS).
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability with a high EPSS score, this flaw is actively targeted by threat actors. Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser session, enabling session hijacking, credential theft, defacement, and unauthorized actions on behalf of authenticated users.
Official Vendor Advisories & References
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Frequently Asked SecOps Questions (CVE-2020-11023)
FAQQ1. How critical is CVE-2020-11023 and is it actively exploited in the wild?
CVE-2020-11023 is rated CVSS 6.1 (MEDIUM) with a 30-day EPSS exploitation probability of 84.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-11023?
Primary impacted vendors include jquery across jquery. Scope summary: jQuery versions >= 1.0.3 and < 3.5.0
Q3. What temporary mitigations or workarounds exist for CVE-2020-11023 before patching?
[Mitigation] Upgrade jQuery to the patched version 3.5.0 or higher, or apply a workaround to bypass the vulnerable htmlPrefilter function Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-11023
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (jquery)
View Category →Perl WebDyne Cross-Site Scripting (XSS) Vulnerability (CVE-2026-78190) Analysis and Mitigation Guide
[Affected Scope] WebDyne versions from 2.014 before 3.022 for Perl
PostyBirb Plus Cross-Site Scripting (XSS) Vulnerability (CVE-2026-120190) Security Advisory
[Affected Scope] PostyBirb Plus versions up to and including 3.1.75
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.