CVE-2020-11022

medium

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (…

Vendor / product: Jquery — jquery

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS

6.1

6.1 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2020-04-29 22:15

Modified: 2026-11-02 18:18

NVD status: Modified

Last synced 1 day ago

Verified against the source API 2026-11-03 07:33 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

jquery / jquery ≥1.2 <3.5.0

drupal / drupal ≥7.0 <7.70, ≥8.7.0 <8.7.14, ≥8.8.0 <8.8.6

debian / debian_linux 9.0

fedoraproject / fedora 31, 32, 33

oracle / agile_product_lifecycle_management_for_process 6.2.0.0

oracle / application_testing_suite 13.3.0.1

oracle / banking_digital_experience 18.1, 18.2, 18.3, 19.1, 19.2, 20.1

oracle / blockchain_platform <21.1.2

oracle / communications_application_session_controller 3.8m0

oracle / communications_billing_and_revenue_management 7.5.0.23.0, 12.0.0.3.0

oracle / communications_diameter_signaling_router_idih\ ≥8.0.0 ≤8.2.2

oracle / communications_eagle_application_processor ≥16.1.0 ≤16.4.0

oracle / communications_services_gatekeeper 7.0

oracle / communications_webrtc_session_controller 7.2

oracle / enterprise_manager_ops_center 12.4.0.0

oracle / enterprise_session_border_controller 8.4

oracle / financial_services_analytical_applications_infrastructure ≥8.0.6.0.0 ≤8.1.0.0.0, ≥8.0.6 ≤8.1.0

oracle / financial_services_analytical_applications_reconciliation_framework ≥8.0.6 ≤8.0.8, 8.1.0

oracle / financial_services_asset_liability_management 8.0.6, 8.0.7, 8.1.0

oracle / financial_services_balance_sheet_planning 8.0.8

oracle / financial_services_basel_regulatory_capital_basic ≥8.0.6 ≤8.0.8, 8.1.0

oracle / financial_services_basel_regulatory_capital_internal_ratings_based_approach ≥8.0.6 ≤8.0.8, 8.1.0

oracle / financial_services_data_foundation ≥8.0.6 ≤8.1.0

oracle / financial_services_data_governance_for_us_regulatory_reporting ≥8.0.6 ≤8.0.9

oracle / financial_services_data_integration_hub 8.0.6, 8.0.7, 8.1.0

oracle / financial_services_funds_transfer_pricing 8.0.6, 8.0.7, 8.1.0

oracle / financial_services_hedge_management_and_ifrs_valuations ≥8.0.6 ≤8.0.8, 8.1.0

oracle / financial_services_institutional_performance_analytics 8.0.6, 8.0.7, 8.1.0

oracle / financial_services_liquidity_risk_management 8.0.6

oracle / financial_services_liquidity_risk_measurement_and_management 8.0.7, 8.0.8, 8.1.0

oracle / financial_services_loan_loss_forecasting_and_provisioning ≥8.0.6 ≤8.0.8, 8.1.0

oracle / financial_services_market_risk_measurement_and_management 8.0.6, 8.0.8

oracle / financial_services_price_creation_and_discovery 8.0.6, 8.0.7

oracle / financial_services_profitability_management 8.0.6, 8.0.7, 8.1.0

oracle / financial_services_regulatory_reporting_for_european_banking_authority ≥8.0.6 ≤8.1.0

oracle / financial_services_regulatory_reporting_for_us_federal_reserve ≥8.0.6 ≤8.0.9

oracle / healthcare_foundation 7.1.1, 7.2.0, 7.2.1, 7.3.0

oracle / hospitality_materials_control 18.1

oracle / hospitality_simphony ≥19.1.0 ≤19.1.2, 18.1, 18.2, 19.1.0-19.1.2

oracle / insurance_accounting_analyzer 8.0.9

oracle / insurance_allocation_manager_for_enterprise_profitability 8.0.8, 8.1.0

oracle / insurance_data_foundation ≥8.0.6 ≤8.1.0, 8.0.6-8.1.0

oracle / insurance_insbridge_rating_and_underwriting ≥5.0.0.0 ≤5.6.0.0, 5.6.1.0

oracle / jdeveloper 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

oracle / peoplesoft_enterprise_peopletools 8.56, 8.57, 8.58

oracle / policy_automation ≥12.2.0 ≤12.2.20

oracle / policy_automation_connector_for_siebel 10.4.6

oracle / policy_automation_for_mobile_devices ≥12.2.0 ≤12.2.20

oracle / retail_back_office 14.0, 14.1

oracle / retail_customer_management_and_segmentation_foundation 19.0

Weakness classification (CWE)

CWE-79

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Vendor advisory: https://jquery.com/upgrade-guide/3.5/

Patch / mitigation: https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77

Patch / mitigation: https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2

Patch / mitigation: https://www.oracle.com/security-alerts/cpuApr2021.html

Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html

Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2022.html

Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2021.html

Patch / mitigation: https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77

Patch / mitigation: https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2

Patch / mitigation: https://jquery.com/upgrade-guide/3.5/

Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html

References

http://security.netapp.com/advisory/ntap-20200511-0006 security-advisories@github.com
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released security-advisories@github.com
https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77 security-advisories@github.com
https://github.com/jquery/jquery/releases/tag/3.5.0 security-advisories@github.com
https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 security-advisories@github.com
https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc security-advisories@github.com
https://github.com/maximebf/php-debugbar/issues/447 security-advisories@github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.y... security-advisories@github.com
https://jquery.com/upgrade-guide/3.5 security-advisories@github.com
https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc... security-advisories@github.com
https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b... security-advisories@github.com
https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d9... security-advisories@github.com
https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a... security-advisories@github.com
https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c60... security-advisories@github.com
https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956... security-advisories@github.com
https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0f... security-advisories@github.com
https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36... security-advisories@github.com
https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8... security-advisories@github.com
https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaa... security-advisories@github.com
https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3... security-advisories@github.com
https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html security-advisories@github.com
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html security-advisories@github.com
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/mes... security-advisories@github.com
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/mes... security-advisories@github.com
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/mes... security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2021-41184