CVE-2020-11022

MEDIUM6.9EPSS 2.5%

Potential XSS vulnerability in jQuery

Published: 4/29/2020Modified: 4/28/2026

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected packages (12)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM6.9CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

References (74)