### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
Update athlon1600/youtube-downloader to 4.0.1; components/jquery to 3.5.0; maximebf/debugbar to 1.19.0; org.webjars.npm:jquery to 3.5.0; jquery to 3.5.0; jquery to 3.5.0; jquery-rails to 4.4.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPotential XSS vulnerability in jQuery affects athlon1600/youtube-downloader (composer), components/jquery (composer), maximebf/debugbar (composer), org.webjars.npm:jquery (maven), jquery (npm), jquery (nuget), jquery-rails (rubygems). Severity is medium. ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
AI coding agents often install or upgrade packages automatically in composer, maven, npm, nuget and rubygems. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
Update athlon1600/youtube-downloader to 4.0.1; components/jquery to 3.5.0; maximebf/debugbar to 1.19.0; org.webjars.npm:jquery to 3.5.0; jquery to 3.5.0; jquery to 3.5.0; jquery-rails to 4.4.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPotential XSS vulnerability in jQuery affects athlon1600/youtube-downloader (composer), components/jquery (composer), maximebf/debugbar (composer), org.webjars.npm:jquery (maven), jquery (npm), jquery (nuget), jquery-rails (rubygems). Severity is medium. ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
AI coding agents often install or upgrade packages automatically in composer, maven, npm, nuget and rubygems. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|
| athlon1600/youtube-downloadercomposer | <=4.0.0 | 4.0.1 |
|---|---|---|
| components/jquerycomposer | >=1.12.0,<3.5.0 | 3.5.0 |
| maximebf/debugbarcomposer | <1.19.0 | 1.19.0 |
| org.webjars.npm:jquerymaven | >=1.12.0,<3.5.0 | 3.5.0 |
| jquerynpm | >=1.12.0,<3.5.0 | 3.5.0 |
| jquerynuget | >=1.12.0,<3.5.0 | 3.5.0 |
| jquery-railsrubygems | <4.4.0 | 4.4.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Package | Affected range | Fixed version |
|---|
| athlon1600/youtube-downloadercomposer | <=4.0.0 | 4.0.1 |
|---|---|---|
| components/jquerycomposer | >=1.12.0,<3.5.0 | 3.5.0 |
| maximebf/debugbarcomposer | <1.19.0 | 1.19.0 |
| org.webjars.npm:jquerymaven | >=1.12.0,<3.5.0 | 3.5.0 |
| jquerynpm | >=1.12.0,<3.5.0 | 3.5.0 |
| jquerynuget | >=1.12.0,<3.5.0 | 3.5.0 |
| jquery-railsrubygems | <4.4.0 | 4.4.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard