~ / search / GHSA-6c3j-c64m-qhgq

GHSA-6c3j-c64m-qhgq

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-11358

Packages

EcosystemPackageAffectedFixed in
npm jquery >= 1.1.4, < 3.4.0 3.4.0
RubyGems jquery-rails < 4.3.4 4.3.4
NuGet jQuery >= 1.1.4, < 3.4.0 3.4.0
PyPI django >= 2.0a1, < 2.1.9 2.1.9
PyPI django >= 2.2a1, < 2.2.2 2.2.2
Maven org.webjars.npm:jquery >= 1.1.4, < 3.4.0 3.4.0
Packagist maximebf/debugbar < 1.19.0 1.19.0

Details

As written in the advisory (Markdown source, shown as plain text).

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.

References

External links from the advisory. They lead to third-party sites.