Skip to content
CVE-2020-11023: jQuery Vulnerability Allows Code Execution from Untrusted HTML

CVE-2020-11023: jQuery Vulnerability Allows Code Execution from Untrusted HTML

First seen 29 Oct 2026, 16:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 18:14 UTC
  • •CVE-2020-11023 allows execution of untrusted code via jQuery methods.
  • •The vulnerability is patched in jQuery 3.5.0; users should upgrade or use DOMPurify.
  • •Active exploitation confirmed as of January 2025, with a CVSS score of 6.9.

CVE-2020-11023 affects jQuery's DOM manipulation methods, allowing execution of untrusted code when passing HTML from untrusted sources, even after sanitization. This vulnerability has been patched in jQuery version 3.5.0. Users are advised to use DOMPurify with the SAFE_FOR_JQUERY option as a workaround if they cannot upgrade. The flaw was first publicly disclosed on May 23, 2022, and was added to CISA's KEV list due to on January 23, 2025. The vulnerability has a CVSS score of 6.9, indicating a medium severity level. Developers using affected jQuery versions should take immediate action to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2020-04-29
CVE-2020-11023 published
CVE-2020-11023 was officially published, detailing the vulnerability in jQuery.
pr.report
2022-05-23
First public PoC released
The first proof of concept for CVE-2020-11023 was made public, demonstrating the exploit.
pr.report
2025-01-23
CISA adds CVE to KEV list
CISA added CVE-2020-11023 to its Known Exploited Vulnerabilities catalog due to confirmed active exploitation.
pr.report
2026-10-29
Advisories published
Two advisories were published regarding CVE-2020-11023, emphasizing the need for immediate action.
pr.report

More articles in this cluster (2)

Following this threat?

Track CVE-2020-11023 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

Which versions of jQuery are affected?
The vulnerability affects all versions of jQuery prior to 3.5.0.
Is there a patch available?
Yes, jQuery 3.5.0 includes a patch for CVE-2020-11023.
What should I do if I can't upgrade?
Use DOMPurify with the SAFE_FOR_JQUERY option to sanitize HTML before passing it to jQuery methods.