FlawAtlas
Search the atlas
CVE-2020-11023 Moderate

Confirmed as exploited

CVE-2020-11023

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Exploit probability 83.8%
Published April 29, 2020
Required by February 13, 2025
Last source change July 8, 2026

01 / ACTION

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

02 / AFFECTED SOFTWARE

Affected packages

Maven org.webjars.npm:jquery

35 explicit affected versions

NuGet jQuery

58 explicit affected versions

Packagist components/jquery

31 explicit affected versions

RubyGems jquery-rails

74 explicit affected versions

npm jquery
Unknown Unknown

142 explicit affected versions

Bitnami drupal

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities CVE-2020-11023

JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.

View original source
Open Source Vulnerabilities CVE-2020-11023

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

View original source
Open Source Vulnerabilities GHSA-jpcq-cgw6-v4j6

### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

View original source
Open Source Vulnerabilities BIT-drupal-2020-11023

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

View original source

05 / REFERENCES

Further evidence