CVE-2020-7656: jQuery

Medium severity, CVSS 6.1. EPSS: 6.4% chance of exploitation in the next 30 days.

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Affected products

• jQuery jQuery: before 1.9.0 (fixed in 1.9.0)
• Juniper Junos: version 21.2 only
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Cloud Backup: affected versions not specified
• Netapp Oncommand System Manager: from 3.0.0, up to and including 3.1.3
• Netapp Snap Creator Framework: affected versions not specified
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only

Published 2020-05-19. Last modified 2026-06-17.