CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- JQuery Cross-Site Scripting (XSS) Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected products
jquery: jquery; debian: debian linux; fedoraproject: fedora; drupal: drupal; oracle: application express; oracle: application testing suite; oracle: banking enterprise collections; oracle: banking platform; oracle: blockchain platform; oracle: business intelligence; oracle: communications analytics; oracle: communications eagle application processor; oracle: communications element manager; oracle: communications interactive session recorder; oracle: communications operations monitor
References10
- blog.jquery.com/2020/04/10/jquery-3-5-0-released Release NotesVendor Advisory
- jquery.com/upgrade-guide/3.5/ Release NotesVendor Advisory
- blog.jquery.com/2020/04/10/jquery-3-5-0-released Release NotesVendor Advisory
- jquery.com/upgrade-guide/3.5/ Release NotesVendor Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 85% percentile: 100 · as of 2 November 2026
- CWE
- CWE-79