CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability

Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days.

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected products

  • Debian Debian Linux: version 9.0 only
  • Drupal Drupal: from 7.0, before 7.70 (fixed in 7.70); from 8.7.0, before 8.7.14 (fixed in 8.7.14); from 8.8.0, before 8.8.6 (fixed in 8.8.6)
  • Fedoraproject Fedora: version 31 only; version 32 only; version 33 only
  • jQuery jQuery: from 1.0.3, before 3.5.0 (fixed in 3.5.0)
  • Netapp Active Iq Unified Manager: affected versions not specified
  • Netapp Cloud Backup: affected versions not specified
  • Netapp Cloud Insights Storage Workload Security Agent: affected versions not specified
  • Netapp h300e Firmware: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410c Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500e Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700e Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Netapp Hci Baseboard Management Controller: affected versions not specified
  • Netapp Max Data: affected versions not specified
  • Netapp Oncommand Insight: affected versions not specified
  • Netapp Oncommand System Manager: from 3.0, up to and including 3.1.3
  • Netapp Snap Creator Framework: affected versions not specified
  • Netapp Snapcenter Server: affected versions not specified
  • Oracle Application Express: before 20.2 (fixed in 20.2)
  • Oracle Application Testing Suite: version 13.3.0.1 only
  • Oracle Banking Enterprise Collections: from 2.7.0, up to and including 2.8.0
  • Oracle Banking Platform: from 2.4.0, up to and including 2.10.0
  • and 27 more

Published 2020-04-29. Last modified 2026-06-17.