QID 980083
QID 980083: Nodejs (npm) Security Update for jquery (GHSA-gxr4-xjj5-5px2)
Security update has been released for jquery to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.
Solution
This problem is patched in jQuery 3.5.0.Workaround:
To workaround the issue without upgrading, adding the following to your code:
```js
jQuery.htmlPrefilter = function( html ) {
return html;
};
```
You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.
To workaround the issue without upgrading, adding the following to your code:
```js
jQuery.htmlPrefilter = function( html ) {
return html;
};
```
You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.
Vendor References
- GHSA-gxr4-xjj5-5px2 -
github.com/advisories/GHSA-gxr4-xjj5-5px2
CVEs related to QID 980083
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-gxr4-xjj5-5px2 | jquery |
github.com/advisories/GHSA-gxr4-xjj5-5px2 |