VDB
KO
MEDIUM 6.9

GHSA-gxr4-xjj5-5px2

Potential XSS vulnerability in jQuery

Details

### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches This problem is patched in jQuery 3.5.0.

### Workarounds To workaround the issue without upgrading, adding the following to your code:

```js jQuery.htmlPrefilter = function( html ) { return html; }; ```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/

### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / jquery
Introduced in: 1.12.0 Fixed in: 3.5.0
Fix npm install jquery@3.5.0
NuGet / jquery
Introduced in: 1.12.0 Fixed in: 3.5.0
Fix dotnet add package jquery --version 3.5.0
RubyGems / jquery-rails
Introduced in: 0 Fixed in: 4.4.0
Fix bundle update jquery-rails
Maven / org.webjars.npm:jquery
Introduced in: 1.12.0 Fixed in: 3.5.0
Fix # pom.xml: bump <version>3.5.0</version> for org.webjars.npm:jquery
Packagist / maximebf/debugbar
Introduced in: 0 Fixed in: 1.19.0
Fix composer require maximebf/debugbar:^1.19.0
Packagist / athlon1600/youtube-downloader
Introduced in: 0

No fixed version published yet for athlon1600/youtube-downloader (composer). Pin to a known-safe version or switch to an alternative.

Packagist / components/jquery
Introduced in: 1.12.0 Fixed in: 3.5.0
Fix composer require components/jquery:^3.5.0

References