PatchTheCVECVE-2020-11022: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing i
59
This week
MEDIUM 6.9WATCHLISTUPGRADEUPGRADEMITIGATE
CVE-2020-11022 is a medium-severity flaw (CVSS 6.9) affecting jquery, drupal, debian linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Why this priority
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 99.2% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2020-04-29 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
jquery jquery UPGRADE
Affected: >= 1.2 and < 3.5.0
Fixed in: 3.5.0
Safe to downgrade to: a release before 1.2
1. Check installed version
apt-cache policy jquery || rpm -q jquery || jquery --version
2. UPGRADE to 3.5.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade jquery
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade jquery
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.2 (Debian / Ubuntu)
apt-cache madison jquery
sudo apt install jquery=<VERSION_BEFORE_1.2>
sudo apt-mark hold jquery
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jquery
sudo dnf downgrade jquery-<VERSION_BEFORE_1.2>
sudo dnf versionlock add jquery
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
drupal drupal UPGRADE
Affected: >= 7.0 and < 7.70 · >= 8.7.0 and < 8.7.14 · >= 8.8.0 and < 8.8.6
Fixed in: 7.70, 8.7.14, 8.8.6
Safe to downgrade to: a release before 7.0
1. Check installed version
apt-cache policy drupal || rpm -q drupal || drupal --version
2. UPGRADE to 7.70 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade drupal
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade drupal
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 7.0 (Debian / Ubuntu)
apt-cache madison drupal
sudo apt install drupal=<VERSION_BEFORE_7.0>
sudo apt-mark hold drupal
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list drupal
sudo dnf downgrade drupal-<VERSION_BEFORE_7.0>
sudo dnf versionlock add drupal
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
debian debian linux MITIGATE
Affected: 9.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
fedoraproject fedora MITIGATE
Affected: 31 · 32 · 33
Fixed in: no fixed release known
Safe to downgrade to: a release before 31
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
oracle agile product lifecycle management for process DOWNGRADE
Affected: 6.2.0.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.2.0.0
1. Check installed version
apt-cache policy agile-product-lifecycle-management-for-process || rpm -q agile-product-lifecycle-management-for-process || agile-product-lifecycle-management-for-process --version
2. No fixed release: DOWNGRADE to a release before 6.2.0.0 (Debian / Ubuntu)
apt-cache madison agile-product-lifecycle-management-for-process
sudo apt install agile-product-lifecycle-management-for-process=<VERSION_BEFORE_6.2.0.0>
sudo apt-mark hold agile-product-lifecycle-management-for-process
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list agile-product-lifecycle-management-for-process
sudo dnf downgrade agile-product-lifecycle-management-for-process-<VERSION_BEFORE_6.2.0.0>
sudo dnf versionlock add agile-product-lifecycle-management-for-process
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle application testing suite DOWNGRADE
Affected: 13.3.0.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 13.3.0.1
1. Check installed version
apt-cache policy application-testing-suite || rpm -q application-testing-suite || application-testing-suite --version
2. No fixed release: DOWNGRADE to a release before 13.3.0.1 (Debian / Ubuntu)
apt-cache madison application-testing-suite
sudo apt install application-testing-suite=<VERSION_BEFORE_13.3.0.1>
sudo apt-mark hold application-testing-suite
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list application-testing-suite
sudo dnf downgrade application-testing-suite-<VERSION_BEFORE_13.3.0.1>
sudo dnf versionlock add application-testing-suite
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: jQuery 1.2 - Cross-Site Scripting (XSS)
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-11022?
jquery: upgrade to 3.5.0; drupal: upgrade to 7.70, 8.7.14, 8.8.6; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-11022 being exploited?
CVE-2020-11022 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-11022 affect?
CVE-2020-11022 affects jquery, drupal, debian linux. Severity is medium (CVSS 6.9). In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is
How urgent is CVE-2020-11022?
Priority 59/100. EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist
Software pages
Drupal vulnerabilities · Debian vulnerabilities · jQuery vulnerabilities
Related CVEs
- CVE-2020-7656 MEDIUM 6.1 UPGRADE DOWNGRADE jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method
- CVE-2020-11023 MEDIUM 6.9 EXPLOITED UPGRADE MITIGATE JQuery Cross-Site Scripting (XSS) Vulnerability
- CVE-2018-18405 MEDIUM 6.1 DOWNGRADE jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element