Live › vulnerability › CVE-2020-11023
Go to dashboardjQuery's DOM manipulation methods can run attacker-supplied script when given HTML-wrapped untrusted input. An attacker who gets such input into a page runs JavaScript in the victim's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| JQuery JQuery | vendor | – | – |
| jquery | vendor | >= 1.0.3, < 3.5.0 | 3.5.0 |
| debian linux | vendor | = 9.0 | – |
| fedoraproject fedora | vendor | = 31 | – |
| fedoraproject fedora | vendor | = 32 | – |
| fedoraproject fedora | vendor | = 33 | – |
| drupal | vendor | >= 7.0, < 7.70 | 7.70 |
| drupal | vendor | >= 8.7.0, < 8.7.14 | 8.7.14 |
| drupal | vendor | >= 8.8.0, < 8.8.6 | 8.8.6 |
| oracle application express | vendor | < 20.2 | 20.2 |
| oracle application testing suite | vendor | = 13.3.0.1 | – |
| oracle banking enterprise collections | vendor | >= 2.7.0, <= 2.8.0 | – |
| oracle banking platform | vendor | >= 2.4.0, <= 2.10.0 | – |
| oracle blockchain platform | vendor | < 21.1.2 | 21.1.2 |
| oracle blockchain platform | vendor | = 21.1.2 | – |
| oracle business intelligence | vendor | = 5.9.0.0.0 | – |
| oracle communications analytics | vendor | = 12.1.1 | – |
| oracle communications eagle application processor | vendor | >= 16.1.0, <= 16.4.0 | – |
| oracle communications element manager | vendor | = 8.1.1 | – |
| oracle communications element manager | vendor | = 8.2.0 | – |
| oracle communications element manager | vendor | = 8.2.1 | – |
| oracle communications interactive session recorder | vendor | >= 6.1, <= 6.4 | – |
| oracle communications operations monitor | vendor | >= 4.1, <= 4.3 | – |
| oracle communications operations monitor | vendor | = 3.4 | – |
| oracle communications services gatekeeper | vendor | = 7.0 | – |
| oracle communications session report manager | vendor | = 8.1.1 | – |
| oracle communications session report manager | vendor | = 8.2.0 | – |
| oracle communications session report manager | vendor | = 8.2.1 | – |
| oracle communications session route manager | vendor | = 8.1.1 | – |
| oracle communications session route manager | vendor | = 8.2.0 | – |
| oracle communications session route manager | vendor | = 8.2.1 | – |
| oracle financial services regulatory reporting for de nederlandsche bank | vendor | = 8.0.4 | – |
| oracle financial services revenue management and billing analytics | vendor | = 2.7 | – |
| oracle financial services revenue management and billing analytics | vendor | = 2.8 | – |
| oracle health sciences inform | vendor | = 6.3.0 | – |
| oracle healthcare translational research | vendor | = 3.2.1 | – |
| oracle healthcare translational research | vendor | = 3.3.1 | – |
| oracle healthcare translational research | vendor | = 3.3.2 | – |
| oracle healthcare translational research | vendor | = 3.4.0 | – |
| oracle hyperion financial reporting | vendor | = 11.1.2.4 | – |
| oracle jd edwards enterpriseone orchestrator | vendor | < 9.2.5.0 | 9.2.5.0 |
Find jQuery versions in your frontend bundles and lockfiles (grep for jquery in package-lock.json, yarn.lock or pnpm-lock.yaml).
3.5.0 release is the commonly cited fix)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2020-11023")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.