Description
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
Recommendation
Update the jquery package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.6.3
- Patched version(s): 1.6.3
References
- GHSA-579v-mp3v-rrw5
- lists.apache.org
- security.netapp.com
- blog.jquery.com
- blog.mindedsecurity.com
- bugs.jquery.com
- www.openwall.com
- www.ubuntu.com
- security.snyk.io
- CVE-2011-4969
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- min-document vulnerable to prototype pollution - CVE-2025-57352
- Remote code execution via the `pretty` option. - CVE-2021-21353
- Vite bypasses server.fs.deny when using ?raw?? - CVE-2025-30208
- GetmeUK ContentTools Cross-Site Scripting (XSS) - CVE-2025-2699
- Tags:
- npm
- jquery
Anything's wrong? Let us know Last updated on September 26, 2023