UpHeron
All vulnerabilities

Packagist · RubyGems · Maven · npm · NuGet · PyPI · Servers and applications

CVE-2019-11358

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Severity
Medium 6.1
Published
20 Apr 2019
Last changed
8 Jul 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.19.0, 2.1.9, 2.2.2, 3.4.0, 4.3.4
Also known as
DRUPAL-CORE-2019-006, GHSA-6c3j-c64m-qhgq, PYSEC-2026-628, SNYK-JS-JQUERY-174006
Sources
NVD, OSV.dev and GitHub

Description

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Affected software

SoftwareAffected versions
Joomla!Servers and applications · cpe:a:joomla:joomla\!
  • From 3.0.0 up to 3.9.4
org.webjars.npm:jqueryMaven · osv:Maven:org.webjars.npm:jquery
  • From 1.1.4 before 3.4.0
jQueryNuGet · osv:NuGet:jQuery
  • From 1.1.4 before 3.4.0
maximebf/debugbarPackagist · osv:Packagist:maximebf/debugbar
  • Every version before 1.19.0
DjangoPyPI · osv:PyPI:django
  • From 2.0a1 before 2.1.9
  • From 2.2a1 before 2.2.2
jquery-railsRubyGems · osv:RubyGems:jquery-rails
  • Every version before 4.3.4
jQuerynpm · osv:npm:jquery
  • From 1.1.4 before 3.4.0

References