GHSA-6c3j-c64m-qhgqMediumCVSS 6.1

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Published
April 26, 2019
Last Modified
November 5, 2024

🔗 CVE IDs covered (1)

CVE-2019-11358 →

📋 Description

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

🎯 Affected products7

  • rubygems/jquery-rails:< 4.3.4
  • pip/django:>= 2.0a1, < 2.1.9
  • pip/django:>= 2.2a1, < 2.2.2
  • npm/jquery:>= 1.1.4, < 3.4.0
  • nuget/jQuery:>= 1.1.4, < 3.4.0
  • maven/org.webjars.npm:jquery:>= 1.1.4, < 3.4.0
  • composer/maximebf/debugbar:< 1.19.0

🔗 References (110)