CVE-2011-4969: jQuery Cross-Site Scripting in location.hash element selection

CVE-2011-4969 · Severity: info · CVSS 5.4 · Published 2022-05-14

jQuery is a popular JavaScript library used to enhance interactivity on websites. Versions before 1.6.3 contain a vulnerability where malicious HTML tags injected through the URL hash fragment can be executed by the browser, allowing attackers to steal user sessions, credentials, or perform actions on behalf of the user. This affects any website using a vulnerable version of jQuery that dynamically selects page elements based on the URL.

Technologies: jQuery, org.webjars.npm:jquery (Maven), jquery-rails (RubyGems). Vendors: jQuery, Maven, RubyGems.

Quick answers

Is CVE-2011-4969 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2011-4969 being exploited in the wild.
How severe is CVE-2011-4969?
Informational severity, with a CVSS score of 5.4, published 14 May 2022.
Which products and versions are affected?
jQuery before 1.6.3; org.webjars.npm:jquery (Maven) ECOSYSTEM:introduced=0,fixed=1.6.3; jquery-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=1.0.16.
Is there a fix for CVE-2011-4969?
Yes. org.webjars.npm:jquery (Maven): upgrade to 1.6.3 or later; jquery-rails (RubyGems): upgrade to 1.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2011-4969 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2011-4969?
Check whether you run jQuery, org.webjars.npm:jquery (Maven) or jquery-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery (Maven): upgrade to 1.6.3 or later
    # set org.webjars.npm:jquery to 1.6.3 in your pom.xml or build.gradle
  • jquery-rails (RubyGems): upgrade to 1.0.16 or later
    bundle update jquery-rails

Technical details

This is a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in jQuery's location.hash handling for DOM element selection. The vulnerable code prioritized HTML tag parsing over ID selectors when using location.hash to select page elements, allowing an attacker to craft a malicious URL with injected HTML/script tags that would be executed in the victim's browser. The attack requires user interaction (clicking a malicious link) and network-level access (the link must be delivered to the target). Successful exploitation grants the attacker arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, malware delivery, and unauthorized actions. The fix (jQuery 1.6.3 and later, released September 2011) prioritizes #id selectors over <tag> patterns to prevent tag injection via location.hash. Patches are available for all affected package managers (npm, NuGet, RubyGems, Maven).

Affected products

  • jQuery jQuery before 1.6.3
  • jQuery jquery-rails before 1.0.16

Identifiers

  • CVE-2011-4969
  • GHSA-579v-mp3v-rrw5

Timeline

  • 2011-06-05: disclosed
  • 2011-09-01: patched: jQuery 1.6.3 released with fix
  • 2022-05-14: advisory: GitHub advisory GHSA-579v-mp3v-rrw5 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.