CVE-2020-11022

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

How to fix CVE-2020-11022

To remediate CVE-2020-11022, upgrade the affected package to a fixed version below.

• —upgrade to 3.5.0 or later
• —upgrade to 3.5.0 or later
• —upgrade to 4.0.1 or later
• —upgrade to 3.5.0 or later
• —upgrade to 1.19.0 or later
• —upgrade to 4.4.0 or later
• —upgrade to 3.5.0 or later

Is CVE-2020-11022 being exploited?

Likely — EPSS is 99.0%, placing CVE-2020-11022 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (7)

• >= 1.12.0, < 3.5.0
• >= 1.12.0, < 3.5.0
• from 0, < 4.0.1
• >= 1.12.0, < 3.5.0
• from 0, < 1.19.0
• from 0, < 4.4.0
• >= 1.12.0, < 3.5.0

CVSS scores

References (50)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-11022
• PATCHgithub.com/jquery/jquery
• WEBsecurity.netapp.com/advisory/ntap-20200511-0006
• WEBblog.jquery.com/2020/04/10/jquery-3-5-0-released
• WEB