Potential XSS vulnerability in jQuery
CVE-2020-11022
6.9MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2020-11022?
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Affected Version(s)
jQuery >= 1.12.0, < 3.5.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.