jQuery vulnerable to Cross-Site Scripting (XSS)

Description

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

Recommendation

Update the jquery package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.3
• Patched version(s): 1.6.3

References

• GHSA-579v-mp3v-rrw5
• lists.apache.org
• blog.mindedsecurity.com
• bugs.jquery.com
• www.openwall.com
• www.ubuntu.com
• security.snyk.io
• security.netapp.com
• blog.jquery.com
• CVE-2011-4969
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @tiptap/extension-link vulnerable to Cross-site Scripting (XSS) - CVE-2025-14284
• jquery-validation vulnerable to Cross-site Scripting - CVE-2025-3573
• jQuery-UI vulnerable to Cross-site Scripting in dialog closeText - CVE-2016-7103
• Cross-Site Scripting (XSS) in jquery - CVE-2015-9251

Tags:

npm

jquery