UpHeron
All vulnerabilities

Packagist · RubyGems · Maven · npm · NuGet

CVE-2020-11023

Potential XSS vulnerability in jQuery

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 23 Jan 2025.

Severity
Medium 6.9
Published
29 Apr 2020
Last changed
10 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.0, 4.4.0
Also known as
BIT-drupal-2020-11023, GHSA-jpcq-cgw6-v4j6
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
org.webjars.npm:jqueryMaven · osv:Maven:org.webjars.npm:jquery
  • From 1.0.3 before 3.5.0
jQueryNuGet · osv:NuGet:jQuery
  • From 1.0.3 before 3.5.0
components/jqueryPackagist · osv:Packagist:components/jquery
  • From 1.0.3 before 3.5.0
jquery-railsRubyGems · osv:RubyGems:jquery-rails
  • Every version before 4.4.0
jQuerynpm · osv:npm:jquery
  • From 1.0.3 before 3.5.0

Known exploited

CISA name
JQuery Cross-Site Scripting (XSS) Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies
13 Feb 2025
Used in ransomware
Not known

References