MediumGHSA-579v-mp3v-rrw5CVE-2011-4969

jQuery vulnerable to Cross-Site Scripting (XSS)

Published 14 May 2022 · Updated 3 Feb 2026

Affected package

Affected: <1.6.3
Fixed in: 1.6.3

Update to the fixed version for your release line, for example:npm install jquery@1.6.3

Details

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

Is GHSA-579v-mp3v-rrw5 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected jquery, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2011-4969
Linkgithub.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9
Packagegithub.com/jquery/jquery
Linkgithub.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2011-4969.yml
Linklists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
Linksecurity.netapp.com/advisory/ntap-20190416-0007
Linksecurity.snyk.io/vuln/SNYK-DOTNET-JQUERY-450224
Linkblog.jquery.com/2011/09/01/jquery-1-6-3-released
Linkblog.mindedsecurity.com/2011/07/jquery-is-sink.html
Linkbugs.jquery.com/ticket/9521
Linkwww.openwall.com/lists/oss-security/2013/01/31/3
Linkwww.ubuntu.com/usn/USN-1722-1

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.