GHSA-rmxg-73gg-4p98MediumCVSS 6.1

Cross-Site Scripting (XSS) in jquery

Published
January 22, 2018
Last Modified
September 25, 2023

🔗 CVE IDs covered (1)

CVE-2015-9251 →

📋 Description

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option.

Recommendation

Update to version 3.0.0 or later.

🎯 Affected products7

  • nuget/jQuery:< 1.12.2
  • nuget/jQuery:>= 1.12.3, < 3.0.0
  • npm/jquery:< 1.12.2
  • npm/jquery:>= 1.12.3, < 3.0.0
  • rubygems/jquery-rails:< 4.2.0
  • maven/org.webjars.npm:jquery:< 1.12.2
  • maven/org.webjars.npm:jquery:>= 1.12.3, < 3.0.0

🔗 References (47)