FlawAtlas
Search the atlas
CVE-2015-9251 Moderate

CVE-2015-9251

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Exploit probability 29.7%
Published January 18, 2018
Required by Not available
Last source change April 10, 2026

02 / AFFECTED SOFTWARE

Affected packages

Maven org.webjars.npm:jquery

25 explicit affected versions

NuGet jQuery

49 explicit affected versions

RubyGems jquery-rails

65 explicit affected versions

npm jquery

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2015-9251

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

View original source
Open Source Vulnerabilities GHSA-rmxg-73gg-4p98

Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option. ## Recommendation Update to version 3.0.0 or later.

View original source

05 / REFERENCES

Further evidence