jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.
Priority LOW 39CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 7 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
Why it matters now
EPSS 0.08632 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jquery (npm): 1.9.0org.webjars.npm:jquery (Maven): 1.9.0+2 more productsRed Hat: 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | jquery (npm) | before 1.9.0 | 1.9.0 | Patch available | GHSA-2pqj-h3vj-pqgw |
| — | org.webjars.npm:jquery (Maven) | before 1.9.0 | 1.9.0 | Patch available | GHSA-2pqj-h3vj-pqgw |
| — | jQuery (NuGet) | before 1.9.0 | 1.9.0 | Patch available | GHSA-2pqj-h3vj-pqgw |
| — | jquery-rails (RubyGems) | before 2.2.0 | 2.2.0 | Patch available | GHSA-2pqj-h3vj-pqgw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- jquery (npm) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-2pqj-h3vj-pqgw
- org.webjars.npm:jquery (Maven) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-2pqj-h3vj-pqgw
- jQuery (NuGet) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-2pqj-h3vj-pqgw
- jquery-rails (RubyGems) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-2pqj-h3vj-pqgw
Remediation
- Fix · GHSA-2pqj-h3vj-pqgw jquery (npm) Fixed in 1.9.0 Advisory →
- Fix · GHSA-2pqj-h3vj-pqgw org.webjars.npm:jquery (Maven) Fixed in 1.9.0 Advisory →
- Fix · GHSA-2pqj-h3vj-pqgw jQuery (NuGet) Fixed in 1.9.0 Advisory →
- Fix · GHSA-2pqj-h3vj-pqgw jquery-rails (RubyGems) Fixed in 2.2.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
Not affected: 13 products
- CloudForms Management Engine 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)
- Red Hat JBoss Fuse Integration Service 2
- Red Hat Mobile Application Platform 4
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 11 (Ocata)
- Red Hat OpenStack Platform 12 (Pike)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 9 (Mitaka)
- Red Hat Satellite 6
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2012-6708
- 2026-10-03 Alias added: GHSA-2pqj-h3vj-pqgw
- 2026-10-13 EPSS moved to the 95th–99th percentile
References
Exploit 1
Advisory 4
Other 17
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- http://packetstormsecurity.com/files/161972/Linksys-EA7500-2.0.8.194281-Cross-Site-Scripting.html
- https://web.archive.org/web/20200227132049/http://www.securityfocus.com/bid/102792
- https://research.insecurelabs.org/jquery/test
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2012-6708.yml
- https://github.com/rails/jquery-rails/blob/v2.2.0/vendor/assets/javascripts/jquery.js#L67
- https://github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L59
- https://github.com/jquery/jquery
- https://bugs.jquery.com/ticket/9521
- https://bugs.jquery.com/ticket/6429
- https://bugs.jquery.com/ticket/12531
More Jquery vulnerabilities
- TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
- TI-2020-08896 jQuery has a potential XSS vulnerability CVSS 3.1MEDIUM 6.9
- TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
- TI-2015-07630 jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a… CVSS 3.0MEDIUM 6.1
- TI-2016-08748 jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that… CVSS 3.1HIGH 7.5
- TI-2011-04277 Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2012-6708 · CVE Program
- CVE-2012-6708 · NVD
- FIRST EPSS
- GHSA-2pqj-h3vj-pqgw · GitHub Advisory Database · CC BY 4.0
- CVE-2012-6708 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences