CVEs / CVE-2020-11023
CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability
- Known exploited in the CISA KEV catalog since 23 Jan 2025
- medium 6.1 CVSS 3.1 (NVD)
- EPSS 84.8% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2020-11023
Summary
JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| jquery jQuery | >= 1.0.3, < 3.5.0 | — |
| Product | Affected | Fixed in |
|---|---|---|
| jquery (npm) | from 1.0.3, before 3.5.0 | 3.5.0 |
| jquery-rails (RubyGems) | before 4.4.0 | 4.4.0 |
| jQuery (NuGet) | from 1.0.3, before 3.5.0 | 3.5.0 |
| org.webjars.npm:jquery (Maven) | from 1.0.3, before 3.5.0 | 3.5.0 |
| components/jquery (Packagist) | from 1.0.3, before 3.5.0 | 3.5.0 |
Package versions from GHSA-jpcq-cgw6-v4j6.
Exploitation
| In CISA KEV since | 23 Jan 2025 |
|---|---|
| Due date for US federal agencies | 13 Feb 2025 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NScored by NVD |
|---|---|
| Weakness | CWE-79 |
References
- CVE-2020-11023 on NVD
- CVE-2020-11023 in the CISA KEV catalog
- https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 (cited by CISA)
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ (cited by CISA)
- CVE-2020-11023 on OSV
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html Broken Link, Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html Exploit, Third Party Advisory, VDB Entry
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released Release Notes, Vendor Advisory
- https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 Third Party Advisory
- https://jquery.com/upgrade-guide/3.5/ Release Notes, Vendor Advisory
- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E Issue Tracking, Mailing List
- https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E Issue Tracking, Mailing List
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.