Actively exploited in the wild
JQuery Cross-Site Scripting (XSS) Vulnerability
JQuery - JQuery · Listed in the CISA KEV since 2025-01-23. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2020-11023
MediumCVSS 6.9KEVSummary
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser context, potentially leading to data theft or session hijacking.
Recommendation
Update jQuery to version 3.5.0 or later.
Other vulnerabilities in jQuery
Original NVD description (English source)
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS