Executive brief
jquery-validation is a popular JavaScript library used to validate form input on websites. A cross-site scripting (XSS) vulnerability in the showLabel() function allows attackers to inject malicious scripts into error messages when validation fails, potentially stealing user credentials or performing unauthorized actions on behalf of users.
Technical details
The vulnerability is a classic cross-site scripting (CWE-79) flaw in the showLabel() function, which uses .html() to inject validation error messages into the DOM. User-controlled data—such as placeholder values or translation strings from a user-localizable dictionary—can contain unescaped HTML/JavaScript that will be executed in the victim's browser. Exploitation requires user interaction (user must trigger form validation), but no authentication is needed. An attacker can craft a malicious form or intercept/modify validation messages to execute arbitrary JavaScript in the context of the vulnerable website. The fix, introduced in version 1.20.0, adds an escapeHtml option to sanitize message content before rendering.
Affected products
- jquery-validation jquery-validation before 1.20.0
Timeline
- 2025-04-15: disclosed: Vulnerability published to GitHub Advisory Database and NVD
- 2025-04-15: patched: Fix released in version 1.20.0 with escapeHtml option
- 2023-02-01: other: Fix PR merged into master branch