CVE-2020-7656: jquery Cross-site Scripting
Vulnerability summary
CVE-2020-7656 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in jquery. EPSS estimates a 6.43% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 19-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
CVSS metrics
11 scores · 6 sources · 3 versions- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · NugetEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · RubygemsEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NugetEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
6.43%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
+0.16 pp
From 6.27% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (snyk.io)
Maturity: unknown
jQuery 3.3.1 - Prototype Pollution & XSS Exploit
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Netapp4 products
- active_iq_unified_managerna
- cloud_backupna
- oncommand_system_manager≥ 3.0.0, ≤ 3.1.3
- snap_creator_frameworkna
Jquery1 product
- jquery< 1.9.0
Juniper1 product
- junos21.2
Npm1 product
- jquery≥ 1.2.1, < 1.9.0
NuGet1 product
- jquery≥ 1.2.1, < 1.9.0
Oracle1 product
Org.webjars.npm1 product
- jquery≥ 1.2.1, < 1.9.0
RubyGems1 product
- jquery-rails< 2.2.0
Ubuntu1 product
- jqueryAll versions (No fix recorded)
9 vendors · 12 products
References
15 links- security.netapp.com/advisory/ntap-20200528-0001/Third Party Advisory
- github.com/jquery/jqueryPACKAGE