Skip to content
CVE IDCVE-2020-23064GitHub advisory IDGHSA-257q-pv89-v3xv

Duplicate Advisory: jQuery Cross Site Scripting vulnerability

CVE-2020-23064 is a rejected CVE ID: the CVE Program withdrew it, so it doesn't describe a valid vulnerability.

Medium6.1Rejected CVEGitHub reviewed

Published 26 Jun 2023Updated 15 May 2024

Rejected by the CVE Program. This ID doesn't describe a valid vulnerability (often a duplicate, or a report that turned out not to be a vulnerability). It is kept here for reference; don't use it for triage.

6.1MediumCVSS 3.1
CVE ID
CVE-2020-23064
GHSA ID
GHSA-257q-pv89-v3xv
EPSS
0.04%higher than 21% of CVEs
Weakness (CWE)
  • CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
KEV status
Not in KEV
Published
26 Jun 2023
Updated
15 May 2024
Ecosystems
  • npm
  • NuGet
  • RubyGems
  • Maven
Assigned by (CNA)
mitre

Summary

Source: OSV (GitHub advisory)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jpcq-cgw6-v4j6. This link is maintained to preserve external references.

Original Description

Cross Site Scripting vulnerability in jQuery v.2.2.0 until v.3.5.0 allows a remote attacker to execute arbitrary code via the <options> element.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Medium6.1Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
Required
Scope S
Changed
Confidentiality C
Low
Integrity I
Low
Availability A
None

Affected packages

Source: OSV (GitHub advisory)

  • jquery
    npm
    pkg:npm/jquery
    Affected versions
    >= 1.0.3, < 3.5.0
    Fixed in
    3.5.0
  • jQuery
    NuGet
    pkg:nuget/jQuery
    Affected versions
    >= 1.0.3, < 3.5.0
    Fixed in
    3.5.0
    Show 58 listed versions
    • 1.10.0
    • 1.10.0.1
    • 1.10.1
    • 1.10.2
    • 1.11.0
    • 1.11.1
    • 1.11.2
    • 1.11.3
    • 1.12.0
    • 1.12.1
    • 1.12.2
    • 1.12.3
  • jquery-rails
    RubyGems
    pkg:gem/jquery-rails
    Affected versions
    < 4.4.0
    Fixed in
    4.4.0
    Show 74 listed versions
    • 0.1.1
    • 0.1.2
    • 0.1.3
    • 0.2
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6
    • 0.2.7
    • 1.0
  • org.webjars.npm:jquery
    Maven
    pkg:maven/org.webjars.npm/jquery
    Affected versions
    >= 1.0.3, < 3.5.0
    Fixed in
    3.5.0
    Show 35 listed versions
    • 1.11.0
    • 1.11.1
    • 1.11.3
    • 1.12.1
    • 1.12.2
    • 1.12.3
    • 1.12.4
    • 1.7.2
    • 1.7.3
    • 1.8.2
    • 1.8.3
    • 1.9.1

Fix

Source: OSV (GitHub advisory)

Fix available

  • jquery: upgrade to 3.5.0 or later
  • jQuery: upgrade to 3.5.0 or later
  • jquery-rails: upgrade to 4.4.0 or later
  • org.webjars.npm:jquery: upgrade to 3.5.0 or later

Patch commits

  • 1d61fd9Patch commitgithub.com/jquery/jquery

    Manipulation: Make jQuery.htmlPrefilter an identity function

    +246 −257 across 18 files

    • src/manipulation.js+1 −8
    • test/data/testinit.js+1 −1
    • test/localfile.html+1 −1
    • test/unit/ajax.js+4 −4
    • test/unit/attributes.js+23 −23
    • test/unit/basic.js+12 −12
    • test/unit/core.js+7 −7
    • test/unit/css.js+56 −56
    • and 10 more files

Vulnerability intelligence

References

Credits

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)No record
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 6 days ago (8 Oct 2026, 04:08 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.