MediumGHSA-gxr4-xjj5-5px2BIT-drupal-2020-11022CVE-2020-11022

Potential XSS vulnerability in jQuery

Published 29 Apr 2020 · Updated 10 Sept 2026

Affected packages

jquerynpm
Affected
>=1.12.0 <3.5.0
Fixed in
3.5.0
Update to the fixed version for your release line, for example:npm install jquery@3.5.0
maximebf/debugbarComposer
Affected
<1.19.0
Fixed in
1.19.0
Update to the fixed version for your release line, for example:composer require maximebf/debugbar:^1.19.0
athlon1600/youtube-downloaderComposer
Affected
<4.0.1
Fixed in
4.0.1
Update to the fixed version for your release line, for example:composer require athlon1600/youtube-downloader:^4.0.1
components/jqueryComposer
Affected
>=1.12.0 <3.5.0
Fixed in
3.5.0
Update to the fixed version for your release line, for example:composer require components/jquery:^3.5.0

Details

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

This problem is patched in jQuery 3.5.0.

Workarounds

To workaround the issue without upgrading, adding the following to your code:

jQuery.htmlPrefilter = function( html ) {
	return html;
};

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

References

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.

Is GHSA-gxr4-xjj5-5px2 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected jquery, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.