# CVE-2012-6708: jQuery Cross-Site Scripting in main jQuery function

Source: https://junglewise.ai/threats/cve-2012-6708-jquery-cross-site-scripting-in-main-jquery-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-01. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2012-6708 · Severity: low · CVSS 3 · Published 2020-09-01

jQuery, a widely used JavaScript library for website interactivity, contains a flaw in how it processes web page elements. An attacker could use this to run unauthorized scripts in a user's browser, potentially leading to the theft of session cookies or sensitive information. This issue affects older versions of the library and can be resolved by updating to a modern version.

Technologies: [org.webjars.npm:jquery (Maven)](https://junglewise.ai/threats/technologies/org-webjars-npm-jquery), [jquery-rails (RubyGems)](https://junglewise.ai/threats/technologies/jquery-rails). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2012-6708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2012-6708 being exploited in the wild.

**How severe is CVE-2012-6708?** Low severity, with a CVSS score of 3, published 1 September 2020.

**Which products and versions are affected?** org.webjars.npm:jquery (Maven) ECOSYSTEM:introduced=0,fixed=1.9.0; jquery-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=2.2.0.

**Is there a fix for CVE-2012-6708?** Yes. org.webjars.npm:jquery (Maven): upgrade to 1.9.0 or later; jquery-rails (RubyGems): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2012-6708 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2012-6708?** Check whether you run org.webjars.npm:jquery (Maven) or jquery-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.webjars.npm:jquery (Maven): upgrade to 1.9.0 or later

  ```sh
  # set org.webjars.npm:jquery to 1.9.0 in your pom.xml or build.gradle
  ```

- jquery-rails (RubyGems): upgrade to 2.2.0 or later

  ```sh
  bundle update jquery-rails
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in jQuery versions prior to 1.9.0. The root cause is an unanchored regular expression in the main jQuery(strInput) function used to differentiate between HTML strings and DOM selectors. In affected versions, the library identifies input as HTML if the '<' character appears anywhere in the string, whereas fixed versions require the string to explicitly start with '<'. An attacker can exploit this by providing a specially crafted string that jQuery misinterprets as executable HTML rather than a selector, leading to client-side code execution. This vulnerability is also tracked as a duplicate under CVE-2017-16011.

## Affected products

- jQuery jquery < 1.9.0
- Rails jquery-rails < 2.2.0

## Identifiers

- CVE-2012-6708
- GHSA-2pqj-h3vj-pqgw

## Timeline

- 2012-06-19: disclosed: Vulnerability originally disclosed
- 2013-01-15: patched: Fixed in jQuery version 1.9.0
- 2018-01-18: advisory: NVD published CVE-2012-6708
- 2020-09-01: advisory: GitHub Advisory published

## References

- [https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d](https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d)
- [https://web.archive.org/web/20200227132049/http://www.securityfocus.com/bid/102792](https://web.archive.org/web/20200227132049/http://www.securityfocus.com/bid/102792)
- [https://snyk.io/vuln/npm:jquery:20120206](https://snyk.io/vuln/npm:jquery:20120206)
- [https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450223](https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450223)
- [https://research.insecurelabs.org/jquery/test](https://research.insecurelabs.org/jquery/test)

## Related threats

- [jQuery Cross Site Scripting in htmlPrefilter](https://junglewise.ai/threats/jquery-cross-site-scripting-in-htmlprefilter-9649f1a0)
- [jQuery Cross-Site Scripting in location.hash element selection](https://junglewise.ai/threats/cve-2011-4969-jquery-cross-site-scripting-in-location-hash-element-selection)
- [jQuery cross-site scripting in load method](https://junglewise.ai/threats/cve-2020-7656-jquery-cross-site-scripting-in-load-method)
- [jQuery DOM manipulation XSS via option elements](https://junglewise.ai/threats/cve-2020-11023-jquery-cross-site-scripting-xss-vulnerability)
- [jQuery XSS in DOM manipulation methods](https://junglewise.ai/threats/cve-2020-11022-jquery-xss-in-dom-manipulation-methods)