VDB
Sign up
MEDIUM6.9

GHSA-gxr4-xjj5-5px2

Potential XSS vulnerability in jQuery

Quick fix

GHSA-gxr4-xjj5-5px2 — jquery: upgrade to the fixed version with the command below.

npm install jquery@3.5.0

Details

### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches This problem is patched in jQuery 3.5.0.

### Workarounds To workaround the issue without upgrading, adding the following to your code:

```js jQuery.htmlPrefilter = function( html ) { return html; }; ```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/

### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/jquery
Introduced in: 1.12.0Fixed in: 3.5.0
Fixnpm install jquery@3.5.0
NuGet/jquery
Introduced in: 1.12.0Fixed in: 3.5.0
Fixdotnet add package jquery --version 3.5.0
RubyGems/jquery-rails
Introduced in: 0Fixed in: 4.4.0
Fixbundle update jquery-rails
Maven/org.webjars.npm:jquery
Introduced in: 1.12.0Fixed in: 3.5.0
Fix# pom.xml: bump <version>3.5.0</version> for org.webjars.npm:jquery
Packagist/maximebf/debugbar
Introduced in: 0Fixed in: 1.19.0
Fixcomposer require maximebf/debugbar:^1.19.0
Packagist/athlon1600/youtube-downloader
Introduced in: 0Fixed in: 4.0.1
Fixcomposer require athlon1600/youtube-downloader:^4.0.1
Packagist/components/jquery
Introduced in: 1.12.0Fixed in: 3.5.0
Fixcomposer require components/jquery:^3.5.0

References