CVE-2020-7656

Description

Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove `<script>` HTML tags that contain a whitespace character, i.e: `</script >`, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation Upgrade to version 1.9.0 or later.

How to fix CVE-2020-7656

To remediate CVE-2020-7656, upgrade the affected package to a fixed version below.

• —upgrade to 1.9.0 or later
• —upgrade to 1.9.0 or later
• —upgrade to 1.9.0 or later
• —upgrade to 2.2.0 or later

Is CVE-2020-7656 being exploited?

Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• >= 1.2.1, < 1.9.0
• >= 1.2.1, < 1.9.0
• >= 1.2.1, < 1.9.0
• from 0, < 2.2.0

CVSS scores

References (12)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-7656
• PATCHgithub.com/jquery/jquery
• WEBgithub.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.js#L203
• WEBgithub.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d