{"id":"CVE-2011-4969","aliases":["AZL-44421","CLSA-2026-1787916782","CLSA-2026-1787920143","CLSA-2026-1787920316","CLSA-2026-1788956475","EUVD-2022-2521","GHSA-579v-mp3v-rrw5"],"status":"published","title":"jQuery vulnerable to Cross-Site Scripting (XSS)","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.19191,"percentile":0.97347,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2013-03-08T22:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"jquery","fixed_in":["1.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"jQuery","fixed_in":["1.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"jquery-rails","fixed_in":["1.0.16"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.npm:jquery","fixed_in":["1.6.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"jQuery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-genshi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.7.9-1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.1-tuxcare.0"},{"fixed":"1.4.1-tuxcare.1"}]}],"versions":["1.4.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.2-tuxcare.0"},{"fixed":"1.4.2-tuxcare.1"}]}],"versions":["1.4.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.3-tuxcare.0"},{"fixed":"1.4.3-tuxcare.1"}]}],"versions":["1.4.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.2-tuxcare.0"},{"fixed":"1.3.2-tuxcare.1"}]}],"versions":["1.3.2"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"jquery","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.3"}]}]},{"source":"osv","ecosystem":"NuGet","package":"jQuery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3"}]}],"versions":["1.4.1","1.4.2","1.4.3","1.4.4","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2"]},{"source":"osv","ecosystem":"RubyGems","package":"jquery-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16"}]}],"versions":["0.1.1","0.1.2","0.1.3","0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","1.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0.rc"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3"}]}]}],"products":[{"vendor":"jquery","product":"jquery"}],"references":[{"url":"http://www.securitytracker.com/id/1036620","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.osvdb.org/80056","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://bugs.jquery.com/ticket/9521","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://blog.jquery.com/2011/09/01/jquery-1-6-3-released/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://blog.mindedsecurity.com/2011/07/jquery-is-sink.html","tags":["x_refsource_MISC","x_transferred","article","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","fix","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05232730","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1722-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/01/31/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/58458","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0007/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4969","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450224","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2011-4969.yml","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0007","tags":["web"]},{"url":"http://blog.jquery.com/2011/09/01/jquery-1-6-3-released","tags":["web"]},{"url":"https://github.com/advisories/GHSA-579v-mp3v-rrw5"},{"url":"https://github.com/jquery/jquery","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2011-4969","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","status":"published","published":"2013-03-08T22:00:00Z","modified":"2024-08-07T00:23:39.422Z","updated_at":"2026-11-02T14:35:37.989579Z"}],"euvd":[{"id":"EUVD-2022-2521","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","status":"published","published":"2013-03-08T22:00:00Z","modified":"2024-08-07T00:23:39Z","updated_at":"2026-11-03T01:39:47.649601Z"}],"ghsa":[{"id":"GHSA-579v-mp3v-rrw5","title":"jQuery vulnerable to Cross-Site Scripting (XSS)","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","status":"published","published":"2022-05-14T01:09:51Z","modified":"2026-01-14T21:43:53Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:17.333958Z"}],"nvd":[{"id":"CVE-2011-4969","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","status":"published","published":"2013-03-08T22:55:01.05Z","modified":"2026-06-16T23:35:44.52Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:12.639283Z"}],"osv":[{"id":"AZL-44421","title":"CVE-2011-4969 affecting package python-genshi 0.7.9-1","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","status":"published","published":"2013-03-08T22:55:01Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CLSA-2026-1787916782","title":"TuxCare security update for jquery (7 CVEs)","description":"TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.1-tuxcare.1.","status":"published","published":"2026-08-28T11:33:02Z","modified":"2026-10-15T09:48:03.108876655Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787920143","title":"TuxCare security update for jquery (8 CVEs)","description":"TuxCare rebuilt jquery to address 8 CVEs. Fixed in 1.4.2-tuxcare.1.","status":"published","published":"2026-08-28T12:29:03Z","modified":"2026-10-15T09:48:03.182510065Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787920316","title":"TuxCare security update for jquery (7 CVEs)","description":"TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.3-tuxcare.1.","status":"published","published":"2026-08-28T12:31:56Z","modified":"2026-10-15T09:48:03.111008671Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788956475","title":"TuxCare security update for jquery (6 CVEs)","description":"TuxCare rebuilt jquery to address 6 CVEs. Fixed in 1.3.2-tuxcare.1.","status":"published","published":"2026-09-09T12:21:15Z","modified":"2026-10-15T09:47:55.440487334Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CVE-2011-4969","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","status":"withdrawn","published":"2013-03-08T22:55:01Z","modified":"2024-06-04T04:00:19Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"GHSA-579v-mp3v-rrw5","title":"jQuery vulnerable to Cross-Site Scripting (XSS)","description":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","status":"published","published":"2022-05-14T01:09:51Z","modified":"2026-02-03T02:56:26.437604Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}