Is jquery safe ? 6 known vulnerabilities, worst severity MODERATE.
// reach 10 direct dependencies
3 carry known advisories, worst CRITICAL
135 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss severity band, no base score published
epss chance of exploitation in 30 days, 97th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-579v-mp3v-rrw5, the advisory selected below
// 6 advisories GHSA-579v-mp3v-rrw5 Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. MODE GHSA-2pqj-h3vj-pqgw Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that jquery may interpret HTML as selectors when given certain inputs, allowing for client side code execution. MODE GHSA-q4m3-2j7h-f7xw Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser. MODE GHSA-jpcq-cgw6-v4j6 Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. KEV MODE GHSA-6c3j-c64m-qhgq jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype. MODE GHSA-rmxg-73gg-4p98 Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option. MODE Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
Checked 2026-10-11 at 01:56 UTC. The most recent advisory here was published 2022-05-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page