Executive brief
jQuery is a widely used JavaScript library that simplifies web development tasks like DOM manipulation and AJAX operations. Versions prior to 1.9.0 contain a flaw in the load method that fails to properly filter out script tags containing whitespace (e.g., </script >), allowing attackers to inject and execute arbitrary JavaScript code in a victim's browser. This could lead to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in the jQuery load method's HTML parsing logic. The regex-based HTML detection (rquickExpr) in versions 1.2.1 through 1.8.x incorrectly recognizes strings containing script tags with trailing whitespace before the closing bracket (e.g., </script >) as non-HTML, causing them to be injected directly into the DOM without sanitization. Attack requires that an attacker can control the data source loaded by the vulnerable load() method, typically via AJAX requests to untrusted or user-controlled endpoints. An attacker can execute arbitrary JavaScript in the victim's browser context. The fix (committed in version 1.9.0) tightens the regex to require HTML strings to start immediately with a less-than sign, eliminating the bypass.
Affected products
- jQuery jQuery 1.2.1 to 1.8.3
- Rails jquery-rails 0.1.1 to 2.1.4
Timeline
- 2020-05-19: disclosed
- 2020-05-20: advisory