# CVE-2020-11023: Potential XSS vulnerability in jQuery

> CVE-2020-11023: Potential XSS vulnerability in jQuery. CVSS 6.9 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2020-11023
Last updated: 2025-10-21T23:35:45Z

- Published: 2020-04-29 00:00 UTC · Updated: 2025-10-21 23:35 UTC · Assigner: GitHub\_M
- CVSS: 6.9 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- EPSS: 84.9%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2025-01-23, federal due date 2025-02-13, ransomware use: Unknown
- CWE: CWE-79

## Description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \<option\> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

## CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

## Affected vendors and products

- jquery: jQuery

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2020-11023)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2020-11023)
- [http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html)
- [http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html)
- [http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html](http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html)
- [https://blog.jquery.com/2020/04/10/jquery-3-5-0-released](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released)
- [https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6](https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6)
- [https://jquery.com/upgrade-guide/3.5/](https://jquery.com/upgrade-guide/3.5/)
- [https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E](https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%2540%3Cgitbox.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E](https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%2540%3Cdev.felix.apache.org%3E)
- [https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E](https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%2540%3Cissues.flink.apache.org%3E)
- [https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E](https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%2540%3Cdev.felix.apache.org%3E)
- [https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E](https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%2540%3Cissues.flink.apache.org%3E)
- [https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E](https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%2540%3Cgitbox.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E](https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%2540%3Cgitbox.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E](https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%2540%3Cgitbox.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E](https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%2540%3Ccommits.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E](https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%2540%3Cgitbox.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E](https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%2540%3Cdev.flink.apache.org%3E)
- [https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E](https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%2540%3Cissues.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E](https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%2540%3Ccommits.nifi.apache.org%3E)
- [https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E](https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%2540%3Cgitbox.hive.apache.org%3E)
- [https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E](https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%2540%3Cdev.hive.apache.org%3E)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/](https://lists.fedoraproject.org/archives/list/package-announce%2540lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/](https://lists.fedoraproject.org/archives/list/package-announce%2540lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/](https://lists.fedoraproject.org/archives/list/package-announce%2540lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/](https://lists.fedoraproject.org/archives/list/package-announce%2540lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/)
- [https://security.gentoo.org/glsa/202007-03](https://security.gentoo.org/glsa/202007-03)
- [https://security.netapp.com/advisory/ntap-20200511-0006/](https://security.netapp.com/advisory/ntap-20200511-0006/)
- [https://www.debian.org/security/2020/dsa-4693](https://www.debian.org/security/2020/dsa-4693)
- [https://www.drupal.org/sa-core-2020-002](https://www.drupal.org/sa-core-2020-002)
- [https://www.oracle.com/security-alerts/cpujul2020.html](https://www.oracle.com/security-alerts/cpujul2020.html)
- [https://www.oracle.com/security-alerts/cpuoct2020.html](https://www.oracle.com/security-alerts/cpuoct2020.html)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2020-11023 · Markdown: https://rewindex.com/cve/CVE-2020-11023.md · JSON: https://rewindex.com/api/v1/cves/CVE-2020-11023 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:04.892Z