CVE-2020-11023: jQuery DOM manipulation XSS via option elements

CVE-2020-11023 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2020-04-29

jQuery is a widely-used JavaScript library for manipulating web page content. A flaw in its HTML handling allows attackers to inject malicious code when untrusted HTML containing option elements is inserted into web pages using jQuery methods like .html() or .append(). This could lead to session hijacking, credential theft, or other account compromise on affected websites.

Technologies: jQuery, org.webjars.npm:jquery (Maven), jquery-rails (RubyGems). Vendors: jQuery, Maven, RubyGems.

Quick answers

Is CVE-2020-11023 exploited in the wild?
Yes. CVE-2020-11023 is known to be exploited in the wild, first recorded on 23 January 2025. Treat it as urgent.
How severe is CVE-2020-11023?
Critical severity, with a CVSS score of 3.1, published 29 April 2020.
Which products and versions are affected?
jQuery 1.0.3 through 3.4.x; org.webjars.npm:jquery (Maven) ECOSYSTEM:introduced=1.0.3,fixed=3.5.0; jquery-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=4.4.0.
Is there a fix for CVE-2020-11023?
Yes. org.webjars.npm:jquery (Maven): upgrade to 3.5.0 or later; jquery-rails (RubyGems): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-11023 attacked?
It is attacked over the network.
Am I affected by CVE-2020-11023?
Check whether you run jQuery, org.webjars.npm:jquery (Maven) or jquery-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery (Maven): upgrade to 3.5.0 or later
    # set org.webjars.npm:jquery to 3.5.0 in your pom.xml or build.gradle
  • jquery-rails (RubyGems): upgrade to 4.4.0 or later
    bundle update jquery-rails

Technical details

jQuery versions 1.0.3 through 3.4.x contain a cross-site scripting (XSS) vulnerability in their DOM manipulation methods (.html(), .append(), and related functions). The vulnerability exists because jQuery does not properly sanitize HTML containing <option> elements before inserting them into the DOM. An attacker can pass malicious HTML from an untrusted source (even if it has been sanitized by other tools) to trigger script execution. The attack requires user interaction (the attacker must control the HTML passed to the jQuery method) but can execute with network reachability. The vulnerability is patched in jQuery 3.5.0; users without immediate access to patching can use DOMPurify with the SAFE_FOR_JQUERY option as a workaround.

Affected products

  • jQuery jQuery 1.0.3 through 3.4.x

Identifiers

  • CVE-2020-11023
  • GHSA-jpcq-cgw6-v4j6

Timeline

  • 2020-04-29: disclosed
  • 2020-04-10: patched: jQuery 3.5.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.