CVE-2020-11022

Name of the Vulnerable Software and Affected Versions jQuery versions 1.2 through 3.5.0

Description The issue is related to the execution of untrusted code when passing HTML from untrusted sources to jQuery's DOM manipulation methods, such as .html(), .append(), and others, even after sanitizing the HTML. This may allow a remote attacker to compromise the integrity of protected information.

Recommendations For jQuery versions 1.12/2.2 or newer: To workaround the issue without upgrading, add the following code:

jQuery.htmlPrefilter = function( html ) {
  return html;
};

For all affected versions: Upgrade to jQuery 3.5.0 to patch the issue.