CVE-2020-11022: jQuery DOM manipulation methods allow XSS even after sanitization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a widely deployed library XSS with a very high EPSS score, though it requires user interaction and is not in KEV.

What it is

jQuery versions 1.12.0 through 3.4.x execute untrusted code when HTML from untrusted sources is passed to DOM manipulation methods such as .html() and .append(), even if that HTML was previously sanitized. The flaw is a cross-site scripting issue patched in jQuery 3.5.0, and it matters because sanitization routines that defenders rely on do not prevent execution in affected versions.

Impact

An attacker can execute arbitrary script in the context of a victim's browser session, enabling session theft, credential capture, or actions as the victim. The CVSS vector shows scope change with low confidentiality and integrity impact and no availability impact.

Attack surface

Reached over the network through web pages or applications that pass untrusted HTML into jQuery DOM manipulation methods; no authentication is required, but user interaction is required per the CVSS vector (UI:R).

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.99215 probability, 0.99934 percentile), indicating substantial observed exploitation likelihood; references include patch and mitigation advisories.

What to do

• Upgrade jQuery to 3.5.0 or later, which patches this issue.
• Update downstream products and packages that bundle jQuery (for example Drupal, Debian, Fedora, Oracle, NetApp, openSUSE) to versions containing the fix.
• Audit application code for use of .html(), .append() and similar DOM manipulation methods with untrusted or user-supplied HTML.
• Apply the mitigation guidance in the jQuery security advisory GHSA-gxr4-xjj5-5px2 where immediate upgrade is not possible.
• Do not rely on HTML sanitizers alone to prevent this issue on affected jQuery versions.

Detection

• Search source code and bundled libraries for jQuery versions between 1.12.0 and 3.4.x.
• Monitor web application logs and client-side telemetry for script injection attempts targeting DOM manipulation sinks.
• Review dependency manifests and SBOMs for jQuery and for downstream products listed as affected.
• Check for unexpected script execution or DOM changes on pages that render user-supplied HTML.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.