GHSA-v73w-r9xg-7cr9
Use of insecure jQuery version in OctoberCMS
GHSA-v73w-r9xg-7cr9 is a vulnerability with no CVSS score yet in october/october, published June 5, 2020. No source lists public exploit code. Fixed in october/october 1.0.466.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.466october/october +3 more
Description
Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.
Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/
For more information
If you have any questions or comments about this advisory:
- Email us at octobercms@luketowers.ca & hello@octobercms.com
Threat Assessment
Assessed as Moderate by the @jquery team.
Acknowledgements
Thanks to @mrgswift for reporting the issue to the October CMS team.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
october/octoberPackagist | 1.0.319 up to 1.0.466 | 1.0.466 |
october/systemPackagist | 1.0.319 up to 1.0.466 | 1.0.466 |
october/octoberPackagist | 1.0.319 up to 1.0.466, plus listed versions v1.0.319v1.0.320v1.0.321v1.0.322v1.0.323 Show 45 moreShow lessv1.0.324v1.0.325v1.0.326v1.0.327v1.0.328v1.0.329v1.0.330v1.0.331v1.0.332v1.0.333v1.0.334v1.0.335v1.0.336v1.0.337v1.0.338v1.0.339v1.0.340v1.0.341v1.0.342v1.0.343v1.0.344v1.0.345v1.0.346v1.0.347v1.0.348v1.0.349v1.0.350v1.0.351v1.0.352v1.0.353v1.0.354v1.0.355v1.0.356v1.0.357v1.0.358v1.0.359v1.0.360v1.0.361v1.0.362v1.0.363v1.0.364v1.0.365v1.0.366v1.0.367v1.0.368 | 1.0.466 |
october/systemPackagist | 1.0.319 up to 1.0.466, plus listed versions v1.0.319v1.0.320v1.0.321v1.0.322v1.0.323 Show 45 moreShow lessv1.0.324v1.0.325v1.0.326v1.0.327v1.0.328v1.0.329v1.0.330v1.0.331v1.0.332v1.0.333v1.0.334v1.0.335v1.0.336v1.0.337v1.0.338v1.0.339v1.0.340v1.0.341v1.0.342v1.0.343v1.0.344v1.0.345v1.0.346v1.0.347v1.0.348v1.0.349v1.0.350v1.0.351v1.0.352v1.0.353v1.0.354v1.0.355v1.0.356v1.0.357v1.0.358v1.0.359v1.0.360v1.0.361v1.0.362v1.0.363v1.0.364v1.0.365v1.0.366v1.0.367v1.0.368 | 1.0.466 |
What each source reports
GitHub AdvisoriesNo score
Use of insecure jQuery version in OctoberCMS
Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.
Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/
For more information
If you have any questions or comments about this advisory:
- Email us at octobercms@luketowers.ca & hello@octobercms.com
Threat Assessment
Assessed as Moderate by the @jquery team.
Acknowledgements
Thanks to @mrgswift for reporting the issue to the October CMS team.
- Record
GHSA-v73w-r9xg-7cr9- Updated
- 2026-11-02
OSVNo score
Use of insecure jQuery version in OctoberCMS
Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.
Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/
For more information
If you have any questions or comments about this advisory:
- Email us at octobercms@luketowers.ca & hello@octobercms.com
Threat Assessment
Assessed as Moderate by the @jquery team.
Acknowledgements
Thanks to @mrgswift for reporting the issue to the October CMS team.
- Record
GHSA-v73w-r9xg-7cr9- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 194 versions. The JSON record has them.