{"id":"CVE-2020-11023","kind":"vulnerability","aliases":["CVE-2020-11023"],"related":[],"title":"In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from…","description":"JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"jQuery's DOM manipulation methods can run attacker-supplied script when given HTML-wrapped untrusted input. An attacker who gets such input into a page runs JavaScript in the victim's browser session.","severity":"medium","cvss":6.9,"epss":null,"exploited":true,"exploited_at":"2025-01-23T00:00:00+00:00","products":[{"name":"JQuery JQuery","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"jquery","fixed":["3.5.0"],"affected":">= 1.0.3, < 3.5.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 31","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 32","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 33","ecosystem":"vendor"},{"name":"drupal","fixed":["7.70"],"affected":">= 7.0, < 7.70","ecosystem":"vendor"},{"name":"drupal","fixed":["8.7.14"],"affected":">= 8.7.0, < 8.7.14","ecosystem":"vendor"},{"name":"drupal","fixed":["8.8.6"],"affected":">= 8.8.0, < 8.8.6","ecosystem":"vendor"},{"name":"oracle application express","fixed":["20.2"],"affected":"< 20.2","ecosystem":"vendor"},{"name":"oracle application testing suite","fixed":[],"affected":"= 13.3.0.1","ecosystem":"vendor"},{"name":"oracle banking enterprise collections","fixed":[],"affected":">= 2.7.0, <= 2.8.0","ecosystem":"vendor"},{"name":"oracle banking platform","fixed":[],"affected":">= 2.4.0, <= 2.10.0","ecosystem":"vendor"},{"name":"oracle blockchain platform","fixed":["21.1.2"],"affected":"< 21.1.2","ecosystem":"vendor"},{"name":"oracle blockchain platform","fixed":[],"affected":"= 21.1.2","ecosystem":"vendor"},{"name":"oracle business intelligence","fixed":[],"affected":"= 5.9.0.0.0","ecosystem":"vendor"},{"name":"oracle communications analytics","fixed":[],"affected":"= 12.1.1","ecosystem":"vendor"},{"name":"oracle communications eagle application processor","fixed":[],"affected":">= 16.1.0, <= 16.4.0","ecosystem":"vendor"},{"name":"oracle communications element manager","fixed":[],"affected":"= 8.1.1","ecosystem":"vendor"},{"name":"oracle communications element manager","fixed":[],"affected":"= 8.2.0","ecosystem":"vendor"},{"name":"oracle communications element manager","fixed":[],"affected":"= 8.2.1","ecosystem":"vendor"},{"name":"oracle communications interactive session recorder","fixed":[],"affected":">= 6.1, <= 6.4","ecosystem":"vendor"},{"name":"oracle communications operations monitor","fixed":[],"affected":">= 4.1, <= 4.3","ecosystem":"vendor"},{"name":"oracle communications operations monitor","fixed":[],"affected":"= 3.4","ecosystem":"vendor"},{"name":"oracle communications services gatekeeper","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"oracle communications session report manager","fixed":[],"affected":"= 8.1.1","ecosystem":"vendor"},{"name":"oracle communications session report manager","fixed":[],"affected":"= 8.2.0","ecosystem":"vendor"},{"name":"oracle communications session report manager","fixed":[],"affected":"= 8.2.1","ecosystem":"vendor"},{"name":"oracle communications session route manager","fixed":[],"affected":"= 8.1.1","ecosystem":"vendor"},{"name":"oracle communications session route manager","fixed":[],"affected":"= 8.2.0","ecosystem":"vendor"},{"name":"oracle communications session route manager","fixed":[],"affected":"= 8.2.1","ecosystem":"vendor"},{"name":"oracle financial services regulatory reporting for de nederlandsche bank","fixed":[],"affected":"= 8.0.4","ecosystem":"vendor"},{"name":"oracle financial services revenue management and billing analytics","fixed":[],"affected":"= 2.7","ecosystem":"vendor"},{"name":"oracle financial services revenue management and billing analytics","fixed":[],"affected":"= 2.8","ecosystem":"vendor"},{"name":"oracle health sciences inform","fixed":[],"affected":"= 6.3.0","ecosystem":"vendor"},{"name":"oracle healthcare translational research","fixed":[],"affected":"= 3.2.1","ecosystem":"vendor"},{"name":"oracle healthcare translational research","fixed":[],"affected":"= 3.3.1","ecosystem":"vendor"},{"name":"oracle healthcare translational research","fixed":[],"affected":"= 3.3.2","ecosystem":"vendor"},{"name":"oracle healthcare translational research","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"oracle hyperion financial reporting","fixed":[],"affected":"= 11.1.2.4","ecosystem":"vendor"},{"name":"oracle jd edwards enterpriseone orchestrator","fixed":["9.2.5.0"],"affected":"< 9.2.5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","exploited","frontend","jquery","package"],"not_affected_if":["no-jquery","untrusted-input-never-passed-to-dom-methods"],"how_to_check":"Find jQuery versions in your frontend bundles and lockfiles (grep for jquery in package-lock.json, yarn.lock or pnpm-lock.yaml).","fix":"Upgrade jQuery to a release that fixes CVE-2020-11023 (the sources do not name the exact version; the jQuery 3.5.0 release is the commonly cited fix).\nSanitize untrusted HTML before passing it to jQuery DOM methods.","status":"open","published_at":"2020-04-29T21:15:11+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:39+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:52:39Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade jQuery to a release that fixes CVE-2020-11023 (the sources do not name the exact version; the jQuery 3.5.0 release is the commonly cited fix).\nSanitize untrusted HTML before passing it to jQuery DOM methods.","reach":"internet","impact":"high","summary":"jQuery's DOM manipulation methods can run attacker-supplied script when given HTML-wrapped untrusted input. An attacker who gets such input into a page runs JavaScript in the victim's browser session.","category":"package","who_cares":["jquery","frontend","browser"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in victim browser, stealing sessions and data.","analyst_note":"Confirm the fixed jQuery version and affected range from the jQuery 3.5.0 release notes or the NVD entry for CVE-2020-11023.","how_to_check":"Find jQuery versions in your frontend bundles and lockfiles (grep for jquery in package-lock.json, yarn.lock or pnpm-lock.yaml).\nunknown","needs_analyst":true,"not_affected_if":["no-jquery","untrusted-input-never-passed-to-dom-methods"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000498,"input_tokens":2656,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-11023':19A,22A '-2020':18A,21A '1.0.3':9A '3.5.0':12A 'action':259C 'analytics':62A,143A,151A 'and':141A,149A 'appli':260C 'application':38A,41A,66A 'attack':194B,205B 'attacker-suppli':193B 'bank':135A 'banking':45A,49A 'billing':142A,150A 'blockchain':52A,55A 'browser':181B,219B,256C 'business':58A 'cisa':257C 'code':248C 'collections':47A 'communications':61A,64A,69A,73A,77A,81A,86A,90A,94A,98A,103A,108A,113A,118A,123A 'contain':15A,222C 'context':251C 'cross':226C 'cross-sit':225C 'cve':17A,20A 'de':133A 'debian':26A 'discontinu':266C 'dom':188B,243C 'drupal':34A,35A,36A 'eagle':65A 'edwards':178A 'element':16A,70A,74A,78A 'enclos':237C 'enterprise':46A 'enterpriseone':179A 'equal':7A 'execut':246C 'exploit':182B 'express':39A 'fedora':29A,31A,33A 'fedoraproject':28A,30A,32A 'financial':128A,137A,145A,174A 'for':132A 'form':234C 'frontend':183B 'gatekeeper':96A 'get':207B 'given':198B 'greater':4A 'health':153A 'healthcare':157A,161A,165A,169A 'html':14A,200B,239C 'html-wrap':199B 'hyperion':173A 'inform':155A 'input':203B,209B,236C 'instruct':264C 'intelligence':59A 'interactive':82A 'javascript':214B 'jd':177A 'jqueri':2A,184B,186B,221C,241C 'jquery':23A,24A,25A 'linux':27A 'malici':233C 'management':140A,148A 'manager':71A,75A,79A,101A,106A,111A,116A,121A,126A 'manipul':189B,244C 'method':190B 'mitig':261C,272C 'monitor':88A,92A 'nederlandsche':134A 'operations':87A,91A 'oracle':37A,40A,44A,48A,51A,54A,57A,60A,63A,68A,72A,76A,80A,85A,89A,93A,97A,102A,107A,112A,117A,122A,127A,136A,144A,152A,156A,160A,164A,168A,172A,176A 'orchestrator':180A 'packag':185B 'page':212B 'pass':13A,232C 'per':262C 'persist':224C 'platform':50A,53A,56A 'processor':67A 'product':270C 'recorder':84A 'regulatory':130A 'report':100A,105A,110A 'reporting':131A,175A 'requir':258C 'research':159A,163A,167A,171A 'revenue':139A,147A 'route':115A,120A,125A 'run':192B,213B 'sciences':154A 'script':196B,228C 'services':95A,129A,138A,146A 'session':83A,99A,104A,109A,114A,119A,124A,220B 'site':227C 'suite':43A 'suppli':195B 'tag':240C 'testing':42A 'translational':158A,162A,166A,170A 'unavail':274C 'untrust':202B,235C,247C 'use':267C 'user':254C 'vendor':263C 'version':3A 'victim':217B 'vulner':230C 'wrap':201B 'xss':229C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-04-29T21:15:11+00:00","kev":{"dateAdded":"2025-01-23","dueDate":"2025-02-13","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-11023","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11023","severity":null,"published_at":"2025-01-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:33+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-11023","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11023","severity":null,"published_at":"2020-04-29T21:15:11+00:00","modified_at":"2026-06-17T02:48:52+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}