Cross-Site Scripting

Overview

Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove “<script>” HTML tags that contain a whitespace character, i.e: “</script >”, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim’s browser.

Recommendation

Upgrade to version 1.9.0 or later.

References

• GitHub Advisory