Executive brief
jQuery is a widely-used JavaScript library for manipulating web page content. A flaw in its HTML handling allows attackers to inject malicious code when untrusted HTML containing option elements is inserted into web pages using jQuery methods like .html() or .append(). This could lead to session hijacking, credential theft, or other account compromise on affected websites.
Technical details
jQuery versions 1.0.3 through 3.4.x contain a cross-site scripting (XSS) vulnerability in their DOM manipulation methods (.html(), .append(), and related functions). The vulnerability exists because jQuery does not properly sanitize HTML containing <option> elements before inserting them into the DOM. An attacker can pass malicious HTML from an untrusted source (even if it has been sanitized by other tools) to trigger script execution. The attack requires user interaction (the attacker must control the HTML passed to the jQuery method) but can execute with network reachability. The vulnerability is patched in jQuery 3.5.0; users without immediate access to patching can use DOMPurify with the SAFE_FOR_JQUERY option as a workaround.
Affected products
- jQuery jQuery 1.0.3 through 3.4.x
Timeline
- 2020-04-29: disclosed
- 2020-04-10: patched: jQuery 3.5.0 released