CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-01-23
EPSS: 84.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-04-29 · updated 2026-06-17
Weakness: CWE-79

Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Summary

CVE-2020-11023 is a cross-site scripting (XSS) flaw in jQuery versions 1.0.3 through 3.5.0. Passing HTML containing <option> elements from untrusted sources—even after sanitization—to DOM manipulation methods like .html() or .append() can execute untrusted code. The vulnerability is actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog, with an EPSS probability of 84.9% and a public exploit available. Affected products include jQuery (fixed in 3.5.0), Drupal (fixed in 7.70, 8.7.14, 8.8.6), Debian Linux, Fedora, and various NetApp products. Apply the vendor patches or discontinue use if mitigations are unavailable.

CVE-2020-11023 هو ثغرة XSS في jQuery من الإصدار 1.0.3 حتى ما قبل 3.5.0. تمرير HTML يحتوي على عناصر <option> من مصادر غير موثوقة - حتى بعد التعقيم - إلى دوال التلاعب بـ DOM مثل .html() أو .append() قد ينفذ تعليمات برمجية غير موثوقة. الثغرة مستغلة فعليًا ومدرجة في كتالوج CISA للثغرات المعروفة الاستغلال، مع احتمال استغلال 84.9% خلال 30 يومًا واستغلال عام متاح. تشمل المنتجات المتأثرة jQuery (تم إصلاحها في 3.5.0)، وDrupal (تم إصلاحها في 7.70 و8.7.14 و8.8.6)، وDebian Linux، وFedora، ومنتجات NetApp متعددة. طبّق تحديثات الشركة المصنعة أو أوقف استخدام المنتج إذا لم تتوفر معالجات.

Affected products

Debian Linux: 9.0
Drupal: from 7.0 before 7.70; from 8.7.0 before 8.7.14; from 8.8.0 before 8.8.6 — fixed in 7.70, 8.7.14, 8.8.6
Fedoraproject Fedora: 31, 32, 33
jQuery: from 1.0.3 before 3.5.0 — fixed in 3.5.0
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Backup: all versions
NetApp Cloud Insights Storage Workload Security Agent: all versions
NetApp H300E Firmware: all versions
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500E Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700E Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Hci Baseboard Management Controller: all versions
NetApp Max Data: all versions
OnCommand Insight: all versions
OnCommand System Manager 9.x: from 3.0 through 3.1.3
NetApp Snap Creator Framework: all versions
NetApp SnapCenter Server: all versions
Oracle Corporation Application Express: before 20.2 — fixed in 20.2
Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
Oracle Banking Enterprise Collections: from 2.7.0 through 2.8.0
Oracle Banking Platform: from 2.4.0 through 2.10.0
Oracle Blockchain Platform: before 21.1.2; 21.1.2 — fixed in 21.1.2
Oracle Corporation Oracle Business Intelligence Enterprise Edition: 5.9.0.0.0
Oracle Communications Analytics: 12.1.1
Oracle Communications Eagle Application Processor: from 16.1.0 through 16.4.0
Oracle Communications Element Manager: 8.1.1, 8.2.0, 8.2.1

How to fix

Upgrade to a fixed version: Drupal 7.70, 8.7.14, 8.8.6; jQuery 3.5.0; Oracle Corporation Application Express 20.2; Oracle Blockchain Platform 21.1.2; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.5.0; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.5.0; Oracle Corporation OSS Support Tools 2.12.41; Tenable Log Correlation Engine 6.0.9; Maven Org.Webjars.Npm:Jquery 3.5.0; Npm Jquery 3.5.0; Nuget Jquery 3.5.0; Packagist Components/Jquery 3.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-11023 or the next vulnerability affects your stack