In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11022
CVSS base score
6.9 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-79
Last modified
November 2, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected products
jquery jquery
drupal drupal
debian debian linux
fedoraproject fedora
oracle agile product lifecycle management for process
oracle application testing suite
oracle banking digital experience
oracle blockchain platform
oracle communications application session controller
oracle communications billing and revenue management
References
- security.netapp.com
- blog.jquery.com
- github.com Patch, Third Party Advisory
- github.com
- github.com Mitigation, Third Party Advisory
- github.com
- github.com
- github.com
- jquery.com
- lists.apache.org