jQuery vulnerable to Cross-Site Scripting (XSS)

Description

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

Recommendation

Update the jquery package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.3
• Patched version(s): 1.6.3

References

• GHSA-579v-mp3v-rrw5
• lists.apache.org
• blog.mindedsecurity.com
• bugs.jquery.com
• www.openwall.com
• www.ubuntu.com
• security.snyk.io
• security.netapp.com
• blog.jquery.com
• CVE-2011-4969
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jquery-validation vulnerable to Cross-site Scripting - CVE-2025-3573
• Nuxt DevTools vulnerable to cross-site scripting (XSS) - CVE-2025-52662
• @tiptap/extension-link vulnerable to Cross-site Scripting (XSS) - CVE-2025-14284
• vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS) - CVE-2024-6783

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

jquery