npm package report

Is jquery safe?

jquery (npm) has 8 known vulnerabilities, the worst rated HIGH. Upgrade to 3.5.0 or later to clear all of them. No malicious-package signal is recorded.

// reach

10 direct dependencies

3 carry known advisories, worst CRITICAL

135 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

7.5

high

CVSS v3.0 base score out of 10

epss

3.2%

medium

chance of exploitation in 30 days, 88th percentile of all CVEs

xyz score

4.8

medium

CyberXYZ composite out of 10

fig. 01 — GHSA-mhpp-875w-9cpv, the advisory selected below

// 8 advisories

GHSA-mhpp-875w-9cpv

HIGHGitHub ratingCVE-2016-10707

Affected versions of jquery use a lowercasing logic on attribute names.

Full advisory text at GitHub advisory or NVD.

// cvss v3.0 vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

// questions

Is jquery safe to install?

CyberXYZ does not call a package safe in absolute terms. It records 8 known vulnerabilities for jquery (npm), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.

Does jquery have known vulnerabilities?

Yes. CyberXYZ records 8 known vulnerabilities for jquery (npm), the worst rated HIGH. These include GHSA-mhpp-875w-9cpv, GHSA-579v-mp3v-rrw5, GHSA-2pqj-h3vj-pqgw, GHSA-q4m3-2j7h-f7xw, GHSA-gxr4-xjj5-5px2.

Which version of jquery should I use?

3.5.0 or later clears every advisory recorded for jquery (npm). Check the release you pick before installing it.

How do I check jquery before installing?

Search jquery in CyberXYZ Check at https://cyberxyz.io/check?q=jquery. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.

Checked 2026-11-14 at 06:45 UTC. The most recent advisory here was published 2022-05-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.