Version 3.7.1

jquery

jQuery JavaScript Library

Install Instructions

npm install jquery
Current Version Release Date August 28, 2023
Language JavaScript/TypeScript
Package URL (purl) pkg:npm/jquery@3.7.1

Find jquery vulnerabilities in your supply chain.

Scan for Free

jquery Vulnerabilities

Sort by
icon CVE (Latest)
  • icon CVE (Latest)
  • icon CVE (Oldest)
  • icon CVSS Score (Highest)
  • icon CVSS Score (Lowest)
CVE question mark icon CVSS Score question mark icon CWE(s) question mark icon EPSS Score question mark icon EPSS % question mark icon Impacted Versions
CVE-2019-11358 Medium 6.1 CWE-1321, CWE-79 0.02335 0.90128
  • 3.0.0–3.3.1
  • 2.1.0–2.2.4
  • 1.5.1–1.12.4
CVE-2020-11022 Medium 6.1 CWE-79 0.06271 0.93845
  • 3.0.0–3.4.1
  • 2.1.0–2.2.4
  • 1.5.1–1.12.4
CVE-2020-11023 Medium 6.1 CWE-79 0.02302 0.9007
  • 3.0.0–3.4.1
  • 2.1.0–2.2.4
  • 1.5.1–1.12.4
CVE-2012-6708 Medium 6.1 CWE-79 0.00823 0.8254
  • 1.5.1–1.8.3
CVE-2015-9251 Medium 6.1 CWE-725, CWE-79 0.0066 0.80242
  • 3.0.0-rc1–3.0.0-beta1
  • 2.1.0–2.2.4
  • 1.5.1–1.12.4
CVE-2020-7656 Medium 6.1 CWE-79 0.00154 0.52855
  • 1.5.1–1.8.3
CVE-2016-10707 High 7.5 CWE-674, CWE-121, CWE-400 0.00236 0.62392
  • 3.0.0-rc1
CVE-2011-4969 Medium 4.3 CWE-79 0.00306 0.70583
  • 1.5.1–1.6.2
CVE-2014-6071 Medium 6.1 CWE-79 0.00135 0.5014
  • 1.5.1

jquery Vulnerability Remediation Guidance

CVE Description Full list of Impacted Versions Fix
CVE-2020-7656 jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. 1.8.3, 1.7.3, 1.7.2, 1.6.2, 1.5.1, 1.8.2, 1.6.3 Major → 3.5.0
CVE-2020-11023 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. 3.2.1, 1.8.3, 2.1.0, 2.2.2, 2.2.0, 2.1.4, 3.4.1, 1.12.3 (Show all) Minor → 3.5.0
CVE-2020-11022 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. 3.2.1, 1.8.3, 2.1.0, 2.2.2, 2.2.0, 2.1.4, 3.4.1, 1.12.3 (Show all) Minor → 3.5.0
CVE-2019-11358 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. 3.2.1, 1.8.3, 2.1.0, 2.2.2, 2.2.0, 2.1.4, 1.12.3, 1.12.1 (Show all) Minor → 3.5.0
CVE-2016-10707 jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit. 3.0.0-rc1 Major → 3.5.0
CVE-2015-9251 jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. 1.8.3, 2.1.0, 2.2.2, 2.2.0, 2.1.4, 1.12.3, 1.12.1, 1.11.3 (Show all) Major → 3.5.0
CVE-2014-6071 jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. 1.5.1 Major → 3.5.0
CVE-2012-6708 jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. 1.8.3, 1.7.3, 1.7.2, 1.6.2, 1.5.1, 1.8.2, 1.6.3 Major → 3.5.0
CVE-2011-4969 Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. 1.6.2, 1.5.1 Major → 3.5.0

Instantly see if these jquery vulnerabilities affect your code.

Scan for Free