jplayer Cross Site Scripting vulnerability

Description

Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.

Recommendation

Update the jplayer package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.3.0
• Patched version(s): 2.3.0

References

• GHSA-3jcq-cwr7-6332
• marc.info
• seclists.org
• www.openwall.com
• www.jplayer.org
• CVE-2013-2022
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Directory Traversal in node-simple-router - CVE-2017-16083
• csvjson vulnerable to prototype injection - CVE-2025-57318
• Prebid.js NPM package briefly compromised - CVE-2025-59038
• devalue prototype pollution vulnerability - CVE-2025-57820

Tags:

npm

jplayer