---
id: "CVE-2020-11023"
kind: "vulnerability"
aliases: ["CVE-2020-11023"]
title: "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from\u2026"
severity: "medium"
cvss: 6.9
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "JQuery JQuery", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "jquery", "fixed": ["3.5.0"], "affected": ">= 1.0.3, < 3.5.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 31", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 32", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 33", "ecosystem": "vendor"}, {"name": "drupal", "fixed": ["7.70"], "affected": ">= 7.0, < 7.70", "ecosystem": "vendor"}, {"name": "drupal", "fixed": ["8.7.14"], "affected": ">= 8.7.0, < 8.7.14", "ecosystem": "vendor"}, {"name": "drupal", "fixed": ["8.8.6"], "affected": ">= 8.8.0, < 8.8.6", "ecosystem": "vendor"}, {"name": "oracle application express", "fixed": ["20.2"], "affected": "< 20.2", "ecosystem": "vendor"}, {"name": "oracle application testing suite", "fixed": [], "affected": "= 13.3.0.1", "ecosystem": "vendor"}, {"name": "oracle banking enterprise collections", "fixed": [], "affected": ">= 2.7.0, <= 2.8.0", "ecosystem": "vendor"}, {"name": "oracle banking platform", "fixed": [], "affected": ">= 2.4.0, <= 2.10.0", "ecosystem": "vendor"}, {"name": "oracle blockchain platform", "fixed": ["21.1.2"], "affected": "< 21.1.2", "ecosystem": "vendor"}, {"name": "oracle blockchain platform", "fixed": [], "affected": "= 21.1.2", "ecosystem": "vendor"}, {"name": "oracle business intelligence", "fixed": [], "affected": "= 5.9.0.0.0", "ecosystem": "vendor"}, {"name": "oracle communications analytics", "fixed": [], "affected": "= 12.1.1", "ecosystem": "vendor"}, {"name": "oracle communications eagle application processor", "fixed": [], "affected": ">= 16.1.0, <= 16.4.0", "ecosystem": "vendor"}, {"name": "oracle communications element manager", "fixed": [], "affected": "= 8.1.1", "ecosystem": "vendor"}, {"name": "oracle communications element manager", "fixed": [], "affected": "= 8.2.0", "ecosystem": "vendor"}, {"name": "oracle communications element manager", "fixed": [], "affected": "= 8.2.1", "ecosystem": "vendor"}, {"name": "oracle communications interactive session recorder", "fixed": [], "affected": ">= 6.1, <= 6.4", "ecosystem": "vendor"}, {"name": "oracle communications operations monitor", "fixed": [], "affected": ">= 4.1, <= 4.3", "ecosystem": "vendor"}, {"name": "oracle communications operations monitor", "fixed": [], "affected": "= 3.4", "ecosystem": "vendor"}, {"name": "oracle communications services gatekeeper", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "oracle communications session report manager", "fixed": [], "affected": "= 8.1.1", "ecosystem": "vendor"}, {"name": "oracle communications session report manager", "fixed": [], "affected": "= 8.2.0", "ecosystem": "vendor"}, {"name": "oracle communications session report manager", "fixed": [], "affected": "= 8.2.1", "ecosystem": "vendor"}, {"name": "oracle communications session route manager", "fixed": [], "affected": "= 8.1.1", "ecosystem": "vendor"}, {"name": "oracle communications session route manager", "fixed": [], "affected": "= 8.2.0", "ecosystem": "vendor"}, {"name": "oracle communications session route manager", "fixed": [], "affected": "= 8.2.1", "ecosystem": "vendor"}, {"name": "oracle financial services regulatory reporting for de nederlandsche bank", "fixed": [], "affected": "= 8.0.4", "ecosystem": "vendor"}, {"name": "oracle financial services revenue management and billing analytics", "fixed": [], "affected": "= 2.7", "ecosystem": "vendor"}, {"name": "oracle financial services revenue management and billing analytics", "fixed": [], "affected": "= 2.8", "ecosystem": "vendor"}, {"name": "oracle health sciences inform", "fixed": [], "affected": "= 6.3.0", "ecosystem": "vendor"}, {"name": "oracle healthcare translational research", "fixed": [], "affected": "= 3.2.1", "ecosystem": "vendor"}, {"name": "oracle healthcare translational research", "fixed": [], "affected": "= 3.3.1", "ecosystem": "vendor"}, {"name": "oracle healthcare translational research", "fixed": [], "affected": "= 3.3.2", "ecosystem": "vendor"}, {"name": "oracle healthcare translational research", "fixed": [], "affected": "= 3.4.0", "ecosystem": "vendor"}, {"name": "oracle hyperion financial reporting", "fixed": [], "affected": "= 11.1.2.4", "ecosystem": "vendor"}, {"name": "oracle jd edwards enterpriseone orchestrator", "fixed": ["9.2.5.0"], "affected": "< 9.2.5.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browser", "exploited", "frontend", "jquery", "package"]
not_affected_if: ["no-jquery", "untrusted-input-never-passed-to-dom-methods"]
published_at: "2020-04-29T21:15:11+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11023", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from…

jQuery's DOM manipulation methods can run attacker-supplied script when given HTML-wrapped untrusted input. An attacker who gets such input into a page runs JavaScript in the victim's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JQuery JQuery affected ? fixed ?
- vendor:jquery affected >= 1.0.3, < 3.5.0 fixed 3.5.0
- vendor:debian linux affected = 9.0 fixed ?
- vendor:fedoraproject fedora affected = 31 fixed ?
- vendor:fedoraproject fedora affected = 32 fixed ?
- vendor:fedoraproject fedora affected = 33 fixed ?
- vendor:drupal affected >= 7.0, < 7.70 fixed 7.70
- vendor:drupal affected >= 8.7.0, < 8.7.14 fixed 8.7.14
- vendor:drupal affected >= 8.8.0, < 8.8.6 fixed 8.8.6
- vendor:oracle application express affected < 20.2 fixed 20.2
- vendor:oracle application testing suite affected = 13.3.0.1 fixed ?
- vendor:oracle banking enterprise collections affected >= 2.7.0, <= 2.8.0 fixed ?
- vendor:oracle banking platform affected >= 2.4.0, <= 2.10.0 fixed ?
- vendor:oracle blockchain platform affected < 21.1.2 fixed 21.1.2
- vendor:oracle blockchain platform affected = 21.1.2 fixed ?
- vendor:oracle business intelligence affected = 5.9.0.0.0 fixed ?
- vendor:oracle communications analytics affected = 12.1.1 fixed ?
- vendor:oracle communications eagle application processor affected >= 16.1.0, <= 16.4.0 fixed ?
- vendor:oracle communications element manager affected = 8.1.1 fixed ?
- vendor:oracle communications element manager affected = 8.2.0 fixed ?
- vendor:oracle communications element manager affected = 8.2.1 fixed ?
- vendor:oracle communications interactive session recorder affected >= 6.1, <= 6.4 fixed ?
- vendor:oracle communications operations monitor affected >= 4.1, <= 4.3 fixed ?
- vendor:oracle communications operations monitor affected = 3.4 fixed ?
- vendor:oracle communications services gatekeeper affected = 7.0 fixed ?
- vendor:oracle communications session report manager affected = 8.1.1 fixed ?
- vendor:oracle communications session report manager affected = 8.2.0 fixed ?
- vendor:oracle communications session report manager affected = 8.2.1 fixed ?
- vendor:oracle communications session route manager affected = 8.1.1 fixed ?
- vendor:oracle communications session route manager affected = 8.2.0 fixed ?
- vendor:oracle communications session route manager affected = 8.2.1 fixed ?
- vendor:oracle financial services regulatory reporting for de nederlandsche bank affected = 8.0.4 fixed ?
- vendor:oracle financial services revenue management and billing analytics affected = 2.7 fixed ?
- vendor:oracle financial services revenue management and billing analytics affected = 2.8 fixed ?
- vendor:oracle health sciences inform affected = 6.3.0 fixed ?
- vendor:oracle healthcare translational research affected = 3.2.1 fixed ?
- vendor:oracle healthcare translational research affected = 3.3.1 fixed ?
- vendor:oracle healthcare translational research affected = 3.3.2 fixed ?
- vendor:oracle healthcare translational research affected = 3.4.0 fixed ?
- vendor:oracle hyperion financial reporting affected = 11.1.2.4 fixed ?
- vendor:oracle jd edwards enterpriseone orchestrator affected < 9.2.5.0 fixed 9.2.5.0

## How to check

Find jQuery versions in your frontend bundles and lockfiles (grep for jquery in package-lock.json, yarn.lock or pnpm-lock.yaml).

## Fix

Upgrade jQuery to a release that fixes CVE-2020-11023 (the sources do not name the exact version; the jQuery 3.5.0 release is the commonly cited fix).
Sanitize untrusted HTML before passing it to jQuery DOM methods.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-11023
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-11023

## From the sources

JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_