XSS in jQuery as used in Drupal, Backdrop CMS, and other products

GHSA-6c3j-c64m-qhgq · CVE-2019-11358 · DRUPAL-CORE-2019-006 · PYSEC-2026-628 · SNYK-JS-JQUERY-174006

Published Apr 26, 2019 · Modified Jul 8, 2026

Description

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

References

6.1 / 10

MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected Packages

Maven/org.webjars.npm:jquery

Fix 3.4.0

Introduced 1.1.4

33 affected versions

1.11.01.11.11.11.31.12.11.12.21.12.31.12.41.7.21.7.31.8.21.8.31.9.12.1.02.1.12.1.1-rc12.1.1-rc22.1.32.1.42.2.02.2.1 +13 more

NuGet/jQuery

Fix 3.4.0

Introduced 1.1.4

56 affected versions

1.10.01.10.0.11.10.11.10.21.11.01.11.11.11.21.11.31.12.01.12.11.12.21.12.31.12.41.4.11.4.21.4.31.4.41.5.01.5.11.5.2 +36 more

Packagist/maximebf/debugbar

Fix 1.19.0

Introduced 0

60 affected versions

1.01.0.11.0.21.0.31.0.41.11.10.01.10.11.13.11.21.31.41.51.5.11.61.6.11.71.7.11.81.9 +40 more

PyPI/django

Fix 2.1.9, 2.2.2

Introduced 2.0a1, 2.2a1

32 affected versions

2.02.0.12.0.102.0.122.0.132.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.0a12.0b12.0rc12.12.1.12.1.22.1.3 +12 more

RubyGems/jquery-rails

Fix 4.3.4

Introduced 0

72 affected versions

0.1.10.1.20.1.30.20.2.10.2.20.2.30.2.40.2.50.2.60.2.71.01.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.16 +52 more

npm/jquery

Fix 3.4.0

Introduced 1.1.4

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes