CVE-2020-11023

CVE-2020-11023 is a cross-site scripting flaw in jQuery versions 1.0.3 through before 3.5.0 in which HTML originating from untrusted sources - even after sanitization - can execute attacker-controlled script when passed to jQuery DOM manipulation methods such as .html() and .append(). It is triggered whenever a web application renders untrusted or user-supplied HTML through these APIs, and the underlying bug was patched in jQuery 3.5.0. Successful exploitation lets an attacker run JavaScript in a victim's browser in the context of the affected site (CVSS 3.1: 6.1, network vector, user interaction required, low confidentiality/integrity impact), potentially enabling session-cookie theft or content injection. Because jQuery ships with countless applications, themes, plugins, and downstream distributions - including Debian, Fedora, Drupal, Oracle, NetApp, and Tenable products - the affected population is very large and not precisely enumerated. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-01-23, confirming exploitation in the wild, and EPSS places its 30-day exploitation probability at 83.8% (100th percentile).

What to do: Upgrade jQuery to 3.5.0 or later everywhere it is used, including copies bundled or cached inside applications, themes, plugins, and frameworks, and apply patches or mitigations per advisories from Debian, Fedora, Drupal, Oracle, NetApp, and Tenable. Because CISA has added this flaw to the Known Exploited Vulnerabilities catalog, apply vendor mitigations or discontinue use of affected components; as an interim measure, avoid passing user-supplied or untrusted HTML to .html(), .append(), and related DOM manipulation methods.