CoreCVE
Back

MEDIUM KEV

Potential XSS vulnerability in jQuery

Published Apr 29, 2020 ·Due Feb 13, 2025

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected products

Remediation

Red Hat statement

Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker. Multiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The 'gcc' and 'tbb' packages were potentially vulnerable via this method. OpenShift Container Platform 4 is not affected because even though it uses the 'gcc' component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.

Red Hat mitigation

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Metrics

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (125)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Apr 29, 2020
Updated Oct 21, 2025
Reserved Mar 30, 2020
Link CVE-2020-11023
CISA Vulnrichment
Updated Jan 23, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2020-11023
Red Hat
Severity Moderate
Public date Apr 29, 2020
Links CVE-2020-11023 - Bugzilla
GHSA-JPCQ-CGW6-V4J6