jQuery vulnerabilitiesjQuery: known vulnerabilities and safe versions
npm: jquery
jQuery has 10 known vulnerability records: 8 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 2 only in Retire.js (CDN builds and advisories without a CVE). 1 record is in CISA's Known Exploited Vulnerabilities catalog; the latest, CVE-2020-11023, was added on January 23, 2025. The latest release is 4.0.0 (endoflife.date).
By branch: 4.x has no known records; 3.x is safe from 3.5.0; 2.x has no fixed release in the records; 1.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 4.x | Supported | 4.0.0 | 0 | — |
| 3.x | Supported | 3.7.1 | 3KEV 1medium | 3.5.0 |
| 2.x | Ended | 2.2.4 | 6KEV 1medium | No fix |
| 1.x | Ended | 1.12.4 | 8KEV 1medium | No fix |
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2020-7656exploit code exists2020-05-19
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.
Affected versions: >= 1.2.1, < 1.9.0
medium 6.1
Fixed in: 1.9.0
EPSS 6.4%
CVE-2020-11023KEV2020-04-29
Potential XSS vulnerability in jQuery
Affected versions: >= 1.0.3, < 3.5.0
medium 6.1
Fixed in: 3.5.0
EPSS 84.8%
CVE-2020-11022exploit code exists2020-04-29
jQuery has a potential XSS vulnerability
Affected versions: >= 1.12.0, < 3.5.0
medium 6.1
Fixed in: 3.5.0
EPSS 99.2%
CVE-2019-11358exploit code exists2019-04-19
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp
Affected versions: >= 1.1.4, < 3.4.0
medium 6.1
Fixed in: 3.4.0
EPSS 86.8%
CVE-2016-107072018-01-18
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.
Affected versions: >= 3.0.0-rc.1, < 3.0.0
high 7.5
Fixed in: 3.0.0
EPSS 3.2%
CVE-2015-9251exploit code exists2018-01-18
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType o
Affected versions: < 1.12.2 · >= 1.12.3, < 3.0.0 · >= 1.4.0, < 1.12.0 · >= 1.12.3, < 3.0.0-beta1
medium 6.1
Fixed in: 1.12.0, 1.12.2, 3.0.0
EPSS 29.7%
CVE-2012-6708exploit code exists2018-01-18
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.
Affected versions: < 1.9.0 · < 1.9.0b1
medium 6.1
Fixed in: 1.9.0
EPSS 8.6%
CVE-2011-49692013-03-08
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inj
Affected versions: < 1.6.3
medium 4.3
Fixed in: 1.6.3
EPSS 19.1%
no CVE
parseHTML() executes scripts in event handlers
Affected versions: >= 2.2.2, < 3.0.0
medium
Fixed in: 3.0.0
no CVE
parseHTML() executes scripts in event handlers
Affected versions: >= 1.8.0, < 2.2.0
medium
Fixed in: 2.2.0
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 31, 2026.