CVE-2020-11022

MediumCVSS 6.9

Published: 29/04/2020(UTC)Updated: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

99.22%

100th percentile - higher than 100% of all known CVEs

Summary

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Risk Assessment

Applications using vulnerable jQuery versions may be exposed to XSS attacks, leading to execution of malicious code in the user's browser.

Recommendation

Update jQuery to version 3.5.0 or later in all web applications.

Other vulnerabilities in jQuery

CVE-2020-11023MediumActively exploited
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS