Cross-site scripting in jquery
Priority LOW 37CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Why it matters now
EPSS 0.06428 93rd percentileScored 2026-11-07
Fix Partial jquery (npm): 1.9.0jQuery (NuGet): 1.9.0+2 more productsRed Hat: 2 advisoriesRed Hat: 3 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | jquery | All versions prior to version 1.9.0 | — | No fix listed | CNA |
| — | jquery (npm) | 1.2.1 to before 1.9.0 | 1.9.0 | Patch available | GHSA-q4m3-2j7h-f7xw |
| — | jQuery (NuGet) | 1.2.1 to before 1.9.0 | 1.9.0 | Patch available | GHSA-q4m3-2j7h-f7xw |
| — | jquery-rails (RubyGems) | before 2.2.0 | 2.2.0 | Patch available | GHSA-q4m3-2j7h-f7xw |
| — | org.webjars.npm:jquery (Maven) | 1.2.1 to before 1.9.0 | 1.9.0 | Patch available | GHSA-q4m3-2j7h-f7xw |
- jquery Vendor— Affected All versions prior to version 1.9.0 Fixed in — No fix listed CNA
- jquery (npm) Vendor— Affected 1.2.1 to before 1.9.0 Fixed in 1.9.0 Patch available GHSA-q4m3-2j7h-f7xw
- jQuery (NuGet) Vendor— Affected 1.2.1 to before 1.9.0 Fixed in 1.9.0 Patch available GHSA-q4m3-2j7h-f7xw
- jquery-rails (RubyGems) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-q4m3-2j7h-f7xw
- org.webjars.npm:jquery (Maven) Vendor— Affected 1.2.1 to before 1.9.0 Fixed in 1.9.0 Patch available GHSA-q4m3-2j7h-f7xw
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jquery:jquery:*:*:*:*:*:node.js:*:* | before 1.9.0 | Vulnerable | JQuery |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* | 3.0.0 – 3.1.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:* | 21.2 | Vulnerable | Juniper |
- cpe:2.3:a:jquery:jquery:*:*:*:*:*:node.js:*:* Versions before 1.9.0 Vulnerable ·JQuery
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.1.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:* Versions 21.2 Vulnerable ·Juniper
Remediation
- Fix · GHSA-q4m3-2j7h-f7xw jquery (npm) Fixed in 1.9.0 Advisory →
- Fix · GHSA-q4m3-2j7h-f7xw jQuery (NuGet) Fixed in 1.9.0 Advisory →
- Fix · GHSA-q4m3-2j7h-f7xw jquery-rails (RubyGems) Fixed in 2.2.0 Advisory →
- Fix · GHSA-q4m3-2j7h-f7xw org.webjars.npm:jquery (Maven) Fixed in 1.9.0 Advisory →
Red Hat 2 advisories
- RHSA-2021:4142 Released 2021-11-09 · Red Hat rating Lowpcs security, bug fix, and enhancement update
- Red Hat Enterprise Linux High Availability (v. 8) pcs-0.10.10-4.el8, pcs-snmp-0.10.10-4.el8
- Red Hat Enterprise Linux Resilient Storage (v. 8) pcs-0.10.10-4.el8, pcs-snmp-0.10.10-4.el8
- RHSA-2020:4211 Released 2020-10-08 · Red Hat rating ModerateRed Hat AMQ Interconnect 1.9.0 release and security update
- Red Hat AMQ Interconnect 1 qpid-dispatch-1.13.0-3.el6_10, qpid-dispatch-1.13.0-3.el7, qpid-dispatch-1.13.0-3.el8 +12
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat AMQ Interconnect 1 | Fixed | RHSA-2020:4211 |
| Red Hat Enterprise Linux High Availability (v. 8) | Fixed | RHSA-2021:4142 |
| Red Hat Enterprise Linux Resilient Storage (v. 8) | Fixed | RHSA-2021:4142 |
Not affected: 19 products
- CloudForms Management Engine 5
- OpenShift Service Mesh 1
- Red Hat Ceph Storage 3
- Red Hat Ceph Storage 4
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 15 (Stein)
- Red Hat OpenStack Platform 16 (Train)
- Red Hat Single Sign-On 7
- Red Hat Software Collections
- Red Hat Storage 3
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7656
- 2026-10-03 Alias added: GHSA-q4m3-2j7h-f7xw
References
Advisory 4
- https://security.netapp.com/advisory/ntap-20200528-0001/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1?language=en_US
- https://nvd.nist.gov/vuln/detail/CVE-2020-7656
Other 8
- https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d
- https://github.com/jquery/jquery/commit/606b863edaff29035960e4d813b45d63b8d92876
- https://github.com/jquery/jquery
- https://github.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.js#L203
- https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#220-19-january-2013
- https://github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L7481
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-7656.yml
- https://security.netapp.com/advisory/ntap-20200528-0001
Sources
- CVE-2020-7656 · CVE Program
- CVE-2020-7656 · NVD
- FIRST EPSS
- GHSA-q4m3-2j7h-f7xw · GitHub Advisory Database · CC BY 4.0
- CVE-2020-7656 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences