Apr 24, 2019 · New Fix for jQuery Vulnerabilities. A security patch has been made for jQuery to mitigate 'prototype pollution.' jQuery is an extremely popular fast, small, and feature-rich front-end JavaScript
An Update on the jQuery-File-Upload Vulnerability - Akamai Oct 30, 2018 Is there a base version of jQuery which has no XSS The security team runs a security scan, in that vulnerability report there is one point that I am struggling with. The project uses jQuery 1.4.x and it causes a XSS vulnerability, namely this one . I need to upgrade jQuery but the latest version will cause a lot of problems. April | 2019 | Official jQuery Blog Note that while jQuery does its best to protect users from security vulnerabilities, jQuery is a DOM manipulation library that will generally do what you tell it to do. In this case, the behavior was likely unexpected, so jQuery.extend will no longer write any properties named __proto__ .
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Inadequate/dangerous jQuery behavior for 3rd party text JQuery vulnerability reported for 2.3.5 gbif/ipt#1378. Closed Copy link Quote reply anarcat commented Jan 18, 2018. CVE-2015-9251 was assigned to track this issue. 👍 3 #47020 (jQuery Update 3.4.0 vulnerability) – WordPress Trac
#47020 (jQuery Update 3.4.0 vulnerability) – WordPress Trac
May 28, 2020