MediumGHSA-v73w-r9xg-7cr9

Use of insecure jQuery version in OctoberCMS

Published 5 Jun 2020 · Updated 2 Dec 2024

Affected packages

october/octoberComposer
Affected
>=1.0.319 <1.0.466
Fixed in
1.0.466
Update to the fixed version for your release line, for example:composer require october/october:^1.0.466
october/systemComposer
Affected
>=1.0.319 <1.0.466
Fixed in
1.0.466
Update to the fixed version for your release line, for example:composer require october/system:^1.0.466

Details

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

Workarounds

Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.

References

  • https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
  • https://jquery.com/upgrade-guide/3.5/

For more information

If you have any questions or comments about this advisory:

  • Email us at [octobercms@luketowers.ca](mailto:octobercms@luketowers.ca) & [hello@octobercms.com](mailto:hello@octobercms.com)

Threat Assessment

Assessed as Moderate by the @jquery team.

Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.

Is GHSA-v73w-r9xg-7cr9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected october/october, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.