CVE-2020-11022 — Potential XSS vulnerability in components/jquery...
MEDIUM
Potential XSS vulnerability in jQuery
Published April 29, 2020Updated September 10, 2026Source: osv
Summary
### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.
### Patches
This problem is patched in jQuery 3.5.0.
### Workarounds
To workaround the issue without upgrading, adding the following to your code:
```js
jQuery.htmlPrefilter = function( html ) {
return html;
};
```
You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.
### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/
### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
Advisory Timeline
- First published April 29, 2020 (2357 days ago).
- Last revised September 10, 2026 — 2324 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Composer
Update components/jquery to 3.5.0 or latercomposer require "components/jquery:^3.5.0"
Composer
Update athlon1600/youtube-downloader to 4.0.1 or latercomposer require "athlon1600/youtube-downloader:^4.0.1"
Composer
Update maximebf/debugbar to 1.19.0 or latercomposer require "maximebf/debugbar:^1.19.0"
npm
Update jquery to 3.5.0 or laternpm install jquery@3.5.0
Maven
Update org.webjars.npm:jquery to 3.5.0 or later<!-- Update pom.xml dependency version to 3.5.0 for org.webjars.npm:jquery -->
Bundler
Update jquery-rails to 4.4.0 or latergem install jquery-rails -v 4.4.0
NuGet
Update jquery to 3.5.0 or laterdotnet add package jquery --version 3.5.0
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (7)
Affects 5 ecosystems: packagist (3), maven (1), npm (1), nuget (1), rubygems (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| components/jquery | packagist | 1.12.0, 1.12.1, 1.12.4, 2.0.0 (+17 more) | 3.5.0 |
| athlon1600/youtube-downloader | packagist | v1.0.0, v1.0.1, v2.0.0, v2.0.1 (+18 more) | 4.0.1 |
| maximebf/debugbar | packagist | 1.0, 1.0.1, 1.0.2, 1.0.3 (+56 more) | 1.19.0 |
| jquery | npm | All versions | 3.5.0 |
| org.webjars.npm:jquery | maven | 1.12.1, 1.12.2, 1.12.3, 1.12.4 (+23 more) | 3.5.0 |
| jquery-rails | rubygems | 0.1.1, 0.1.2, 0.1.3, 0.2 (+70 more) | 4.4.0 |
| jquery | nuget | 1.12.0, 1.12.1, 1.12.2, 1.12.3 (+24 more) | 3.5.0 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-79Cross-site Scripting (XSS)MITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 6.9 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-11022ADVISORY
- https://github.com/maximebf/php-debugbar/issues/447WEB
- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77WEB
- https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fcWEB
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-releasedWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3WWEB
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.htmlWEB
- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.htmlWEB
- https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.htmlWEB
- https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.htmlWEB
- https://security.gentoo.org/glsa/202007-03WEB
- https://www.debian.org/security/2020/dsa-4693WEB
- https://www.drupal.org/sa-core-2020-002WEB
- https://www.oracle.com//security-alerts/cpujul2021.htmlWEB
- https://www.oracle.com/security-alerts/cpuApr2021.htmlWEB
- https://www.oracle.com/security-alerts/cpuapr2022.htmlWEB
- https://www.oracle.com/security-alerts/cpujan2021.htmlWEB
- https://www.oracle.com/security-alerts/cpujan2022.htmlWEB
- https://www.oracle.com/security-alerts/cpujul2020.htmlWEB
- https://www.oracle.com/security-alerts/cpujul2022.htmlWEB
- https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB
- https://www.oracle.com/security-alerts/cpuoct2021.htmlWEB
- https://www.tenable.com/security/tns-2020-10WEB
- https://www.tenable.com/security/tns-2020-11WEB
- https://www.tenable.com/security/tns-2021-02WEB
- https://www.tenable.com/security/tns-2021-10WEB
- https://github.com/Athlon1600/youtube-downloader/releases/tag/v4.0.1WEB
- https://github.com/jquery/jqueryPACKAGE
- https://github.com/jquery/jquery/releases/tag/3.5.0WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.ymlWEB
- https://jquery.com/upgrade-guide/3.5WEB
- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3EWEB
- https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3EWEB
- https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@%3Cissues.flink.apache.org%3EWEB
- https://lists.debian.org/debian-lts-announce/2021/03/msg00033.htmlWEB
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBYWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7KWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6BWEB
- https://security.netapp.com/advisory/ntap-20200511-0006WEB
Frequently Asked Questions
- What is CVE-2020-11022?
- Potential XSS vulnerability in jQuery This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.9/10).
- How do I check if my project is affected by CVE-2020-11022?
- CVE-2020-11022 affects components/jquery, athlon1600/youtube-downloader and maximebf/debugbar (and 3 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-11022 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
6.9
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-gxr4-xjj5-5px2
BIT-drupal-2020-11022
Related CVEs
- CVE-2016-10707HIGH
Denial of Service in jquery
- CVE-2019-11358MEDIUM
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
- CVE-2021-41182MEDIUM
XSS in the `altField` option of the Datepicker widget in jquery-ui
- CVE-2021-41184MEDIUM
XSS in the `of` option of the `.position()` util in jquery-ui
- CVE-2022-31160MEDIUM
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
- CVE-2016-7103MEDIUM
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
- CVE-2021-41183MEDIUM
XSS in `*Text` options of the Datepicker widget in jquery-ui
- CVE-2020-11023MEDIUM
Potential XSS vulnerability in jQuery
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies