FlawAtlas
Search the atlas
CVE-2019-11358 Moderate

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.

Exploit probability 87.2%
Published July 2, 2026
Required by Not available
Last source change July 6, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

250 explicit affected versions

Packagist drupal/core

95 explicit affected versions

Maven org.webjars.npm:jquery

33 explicit affected versions

NuGet jQuery

56 explicit affected versions

Packagist maximebf/debugbar

60 explicit affected versions

PyPI django

32 explicit affected versions

RubyGems jquery-rails

72 explicit affected versions

npm jquery
PyPI django

32 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

View original source
Open Source Vulnerabilities DRUPAL-CORE-2019-006

The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their [release notes](https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/): > jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable \_\_proto\_\_ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It's possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release backports the fix to jQuery.extend(), without making any other changes to the jQuery version that is included in Drupal core (3.2.1 for Drupal 8 and 1.4.4 for Drupal 7) or running on the site via some other module such as [jQuery Update](https://www.drupal.org/project/jquery_update). *2019-04-22, edited to add CVE.*

View original source
Open Source Vulnerabilities GHSA-6c3j-c64m-qhgq

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.

View original source
Open Source Vulnerabilities PYSEC-2026-628

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.

View original source

05 / REFERENCES

Further evidence