CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-04-29
jQuery Remote Cross-Site Scripting (XSS) Vulnerability via DOM Manipulation Methods (CVE-2020-11023)
[Affected Scope] jQuery versions greater than or equal to 1.0.3 and before 3.5.0
[Impact] Passing untrusted HTML to jQuery's DOM manipulation methods (e.g., .html(), .append()) can execute arbitrary JavaScript code even after sanitization
[Mitigation] Upgrade jQuery to the patched version 3.5.0 or higher, or apply a workaround to bypass the vulnerable htmlPrefilter function