Every CVE Search/ Get API key

CVE-2020-7656

Cross-Site Scripting in jquery

6.1 MediumPublic exploitFix available

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

6.43%Up 5.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Record
CVE-2020-7656
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Record
CVE-2020-7656
Updated
2026-11-02
EUVDEUVD-2020-0437 No score

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Record
EUVD-2020-0437
Updated
2026-11-03
GitHub AdvisoriesGHSA-q4m3-2j7h-f7xw 5.3

Cross-Site Scripting in jquery

Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 1.9.0 or later.

Record
GHSA-q4m3-2j7h-f7xw
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Record
CVE-2020-7656
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-q4m3-2j7h-f7xw 5.3

Cross-Site Scripting in jquery

Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 1.9.0 or later.

Record
GHSA-q4m3-2j7h-f7xw
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
Show 11 moreShow less
OSVRHSA-2020:4211 6.1

Red Hat Security Advisory: Red Hat AMQ Interconnect 1.9.0 release and security update

Record
RHSA-2020:4211
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2021:4142 6.1

Red Hat Security Advisory: pcs security, bug fix, and enhancement update

Record
RHSA-2021:4142
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2021:4142 6.1

Low: pcs security, bug fix, and enhancement update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594)

Security Fix(es):

  • jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656)

  • jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record
RLSA-2021:4142
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-7656 6.1

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Record
UBUNTU-CVE-2020-7656
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2021:4142 No score

Low: pcs security, bug fix, and enhancement update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594)

Security Fix(es):

  • jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656)

  • jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:4142
Updated
2026-11-02
OSVCLSA-2026-1773188121 No score

TuxCare security update for jquery (5 CVEs)

TuxCare rebuilt jquery to address 5 CVEs. Fixed in 1.8.2-tuxcare.1.

Record
CLSA-2026-1773188121
Updated
2026-11-02
OSVCLSA-2026-1787557579 No score

TuxCare security update for jquery (6 CVEs)

TuxCare rebuilt jquery to address 6 CVEs. Fixed in 1.8.3-tuxcare.1.

Record
CLSA-2026-1787557579
Updated
2026-11-02
OSVCLSA-2026-1787916782 No score

TuxCare security update for jquery (7 CVEs)

TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.1-tuxcare.1.

Record
CLSA-2026-1787916782
Updated
2026-11-02
OSVCLSA-2026-1787920143 No score

TuxCare security update for jquery (8 CVEs)

TuxCare rebuilt jquery to address 8 CVEs. Fixed in 1.4.2-tuxcare.1.

Record
CLSA-2026-1787920143
Updated
2026-11-02
OSVCLSA-2026-1787920316 No score

TuxCare security update for jquery (7 CVEs)

TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.3-tuxcare.1.

Record
CLSA-2026-1787920316
Updated
2026-11-02
OSVCLSA-2026-1788956475 No score

TuxCare security update for jquery (6 CVEs)

TuxCare rebuilt jquery to address 6 CVEs. Fixed in 1.3.2-tuxcare.1.

Record
CLSA-2026-1788956475
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jquery-rails
RubyGems
 before 2.2.0
2.2.0
jquery
npm
 1.2.1 up to 1.9.0
1.9.0
jQuery
NuGet
 1.2.1 up to 1.9.0
1.9.0
org.webjars.npm:jquery
Maven
 1.2.1 up to 1.9.0
1.9.0
pcs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 0.10.10-4.el8.alma
0.10.10-4.el8.alma
pcs-snmp
AlmaLinux:8
From an advisory covering 2 CVEs
 before 0.10.10-4.el8.alma
0.10.10-4.el8.alma
jquery
TuxCare:npm
From an advisory covering 5 CVEs
 1.8.2-tuxcare.0 up to 1.8.2-tuxcare.1, plus listed versions
1.8.2
1.8.2-tuxcare.1
jquery
TuxCare:npm
From an advisory covering 6 CVEs
 1.8.3-tuxcare.0 up to 1.8.3-tuxcare.1, plus listed versions
1.8.3
1.8.3-tuxcare.1
jquery
TuxCare:npm
From an advisory covering 7 CVEs
 1.4.1-tuxcare.0 up to 1.4.1-tuxcare.1, plus listed versions
1.4.1
1.4.1-tuxcare.1
jquery
TuxCare:npm
From an advisory covering 8 CVEs
 1.4.2-tuxcare.0 up to 1.4.2-tuxcare.1, plus listed versions
1.4.2
1.4.2-tuxcare.1
Show 31 moreShow less
Affected packages
PackageAffectedFixed
jquery
TuxCare:npm
From an advisory covering 7 CVEs
 1.4.3-tuxcare.0 up to 1.4.3-tuxcare.1, plus listed versions
1.4.3
1.4.3-tuxcare.1
jquery
TuxCare:npm
From an advisory covering 6 CVEs
 1.3.2-tuxcare.0 up to 1.3.2-tuxcare.1, plus listed versions
1.3.2
1.3.2-tuxcare.1
jQuery
NuGet
 1.2.1 up to 1.9.0, plus listed versions
1.4.11.4.21.4.31.4.41.5.0
Show 15 moreShow less
1.5.11.5.21.6.01.6.11.6.21.6.31.6.41.7.01.7.11.7.1.11.7.21.8.01.8.11.8.21.8.3
1.9.0
jquery-rails
RubyGems
 before 2.2.0, plus listed versions
0.1.10.1.20.1.30.20.2.1
Show 35 moreShow less
0.2.20.2.30.2.40.2.50.2.60.2.71.01.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.0.rc2.0.12.0.22.0.32.1.02.1.12.1.22.1.32.1.4
2.2.0
org.webjars.npm:jquery
Maven
 1.2.1 up to 1.9.0, plus listed versions
1.7.21.7.31.8.21.8.3
1.9.0
qpid-dispatch
Red Hat:amq_interconnect:1::el6
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el6_10
0:1.13.0-3.el6_10
qpid-dispatch-console
Red Hat:amq_interconnect:1::el6
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el6_10
0:1.13.0-3.el6_10
qpid-dispatch-debuginfo
Red Hat:amq_interconnect:1::el6
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el6_10
0:1.13.0-3.el6_10
qpid-dispatch-docs
Red Hat:amq_interconnect:1::el6
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el6_10
0:1.13.0-3.el6_10
qpid-dispatch-router
Red Hat:amq_interconnect:1::el6
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el6_10
0:1.13.0-3.el6_10
qpid-dispatch-tools
Red Hat:amq_interconnect:1::el6
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el6_10
0:1.13.0-3.el6_10
qpid-dispatch
Red Hat:amq_interconnect:1::el7
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el7
0:1.13.0-3.el7
qpid-dispatch-console
Red Hat:amq_interconnect:1::el7
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el7
0:1.13.0-3.el7
qpid-dispatch-debuginfo
Red Hat:amq_interconnect:1::el7
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el7
0:1.13.0-3.el7
qpid-dispatch-docs
Red Hat:amq_interconnect:1::el7
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el7
0:1.13.0-3.el7
qpid-dispatch-router
Red Hat:amq_interconnect:1::el7
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el7
0:1.13.0-3.el7
qpid-dispatch-tools
Red Hat:amq_interconnect:1::el7
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el7
0:1.13.0-3.el7
qpid-dispatch
Red Hat:amq_interconnect:1::el8
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el8
0:1.13.0-3.el8
qpid-dispatch-console
Red Hat:amq_interconnect:1::el8
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el8
0:1.13.0-3.el8
qpid-dispatch-debugsource
Red Hat:amq_interconnect:1::el8
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el8
0:1.13.0-3.el8
qpid-dispatch-docs
Red Hat:amq_interconnect:1::el8
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el8
0:1.13.0-3.el8
qpid-dispatch-router
Red Hat:amq_interconnect:1::el8
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el8
0:1.13.0-3.el8
qpid-dispatch-router-debuginfo
Red Hat:amq_interconnect:1::el8
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el8
0:1.13.0-3.el8
qpid-dispatch-tools
Red Hat:amq_interconnect:1::el8
From an advisory covering 3 CVEs
 before 0:1.13.0-3.el8
0:1.13.0-3.el8
pcs
Red Hat:enterprise_linux:8::highavailability
From an advisory covering 3 CVEs
 before 0:0.10.10-4.el8
0:0.10.10-4.el8
pcs-snmp
Red Hat:enterprise_linux:8::highavailability
From an advisory covering 3 CVEs
 before 0:0.10.10-4.el8
0:0.10.10-4.el8
pcs
Red Hat:enterprise_linux:8::resilientstorage
From an advisory covering 3 CVEs
 before 0:0.10.10-4.el8
0:0.10.10-4.el8
pcs-snmp
Red Hat:enterprise_linux:8::resilientstorage
From an advisory covering 3 CVEs
 before 0:0.10.10-4.el8
0:0.10.10-4.el8
pcs
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:0.10.10-4.el8
0:0.10.10-4.el8
jquery
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.7.2+dfsg-2ubuntu11.7.2+dfsg-2ubuntu1+esm1
 None known
jquery
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.7.2+dfsg-3ubuntu21.11.3+dfsg-41.11.3+dfsg-4ubuntu0.1~esm1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBjQuery 3.3.1 - Prototype Pollution & XSS Exploit2025-04-08

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-7656 is a medium vulnerability (CVSS 6.1) in Jquery, published May 19, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.43%, the 93rd percentile. Fixed in jquery-rails 2.2.0.

References

Show 67 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open