MediumGHSA-q4m3-2j7h-f7xwCVE-2020-7656SNYK-JS-JQUERY-569619
Cross-Site Scripting in jquery
Published 20 May 2020 · Updated 8 Jul 2026
Affected package
jquerynpm
- Affected
- >=1.2.1 <1.9.0
- Fixed in
- 1.9.0
Update to the fixed version for your release line, for example:
npm install jquery@1.9.0Details
Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 1.9.0 or later.
Is GHSA-q4m3-2j7h-f7xw in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected jquery, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2020-7656
- Linkgithub.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d
- Linkgithub.com/jquery/jquery/commit/606b863edaff29035960e4d813b45d63b8d92876
- Packagegithub.com/jquery/jquery
- Linkgithub.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.js#L203
- Linkgithub.com/rails/jquery-rails/blob/master/CHANGELOG.md#220-19-january-2013
- Linkgithub.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L7481
- Linkgithub.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-7656.yml
- Linksecurity.netapp.com/advisory/ntap-20200528-0001
- Linksnyk.io/vuln/SNYK-JS-JQUERY-569619
- Linksupportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1?language=en_US
- Linkwww.oracle.com/security-alerts/cpujul2022.html
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.