GHSA-wv67-q8rr-grjp CVE-2019-5428
Duplicate Advisory: Prototype Pollution in jquery
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- Available
- 4 packages have a fixed version
Description
Duplicate Advisory
This advisory is a duplicate of GHSA-6c3j-c64m-qhgq. This link is maintained to preserve external references.
Original Description
Versions of jquery prior to 3.4.0 are vulnerable to Prototype Pollution. The extend() method allows an attacker to modify the prototype for Object causing changes in properties that will exist on all objects.
Recommendation
Upgrade to version 3.4.0 or later.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.webjars.npm:jquery | < 3.4.0 |
3.4.0 |
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| jquery | < 3.4.0 |
3.4.0 |
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| jquery-rails | < 3.4.0 |
3.4.0 |
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| jquery | < 3.4.0 |
3.4.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.webjars.npm:jquery Maven → 3.4.0
- maven
<dependency><groupId>org.webjars.npm</groupId><artifactId>jquery</artifactId><version>3.4.0</version></dependency>- gradle
implementation("org.webjars.npm:jquery:3.4.0")
jquery NuGet → 3.4.0
- dotnet
dotnet add package jquery --version 3.4.0
jquery-rails RubyGems → 3.4.0
- bundler
bundle update jquery-rails # Gemfile: gem "jquery-rails", ">= 3.4.0"
jquery npm → 3.4.0
- npm
npm install jquery@3.4.0- yarn
yarn add jquery@3.4.0- pnpm
pnpm add jquery@3.4.0
References
Advisories
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2020-11023 Potential XSS vulnerability in jQuery | Medium Known exploited | Also affects jquery |
| GHSA-579v-mp3v-rrw5 jQuery vulnerable to Cross-Site Scripting (XSS) | Medium | Also affects jquery |
| GHSA-2pqj-h3vj-pqgw Cross-Site Scripting in jquery | Medium | Also affects jquery |
| GHSA-q4m3-2j7h-f7xw Cross-Site Scripting in jquery | Medium | Also affects jquery |
| GHSA-gxr4-xjj5-5px2 Potential XSS vulnerability in jQuery | Medium | Also affects jquery |
| DRUPAL-CORE-2019-006 XSS in jQuery as used in Drupal, Backdrop CMS, and other products | Medium | Also affects jquery |
| GHSA-mhpp-875w-9cpv Denial of Service in jquery | High | Also affects jquery |
| GHSA-rmxg-73gg-4p98 Cross-Site Scripting (XSS) in jquery | Medium | Also affects jquery |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor