GHSA-2hwp-g4g7-mwwj
Reflected Cross-Site Scripting in jquery.terminal
Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization.
Recommendation
Upgrade to version 1.21.0 or later
What each source reports
GitHub AdvisoriesNo score
Reflected Cross-Site Scripting in jquery.terminal
Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization.
Recommendation
Upgrade to version 1.21.0 or later
- Record
GHSA-2hwp-g4g7-mwwj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Reflected Cross-Site Scripting in jquery.terminal
Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization.
Recommendation
Upgrade to version 1.21.0 or later
- Record
GHSA-2hwp-g4g7-mwwj- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jquery.terminalnpm | before 1.21.0 | 1.21.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2hwp-g4g7-mwwj is a vulnerability with no CVSS score yet in jquery.terminal, published May 29, 2019. No source lists public exploit code. Fixed in jquery.terminal 1.21.0.