CVE-2020-11022EPSS p99.9%

CVE-2020-11022CVE-2020-11022

jquery / jquery

Description

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Scoring

CVSS 6.9 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS99.22% probability of exploitation · percentile 99.9% · 2026-11-03T12:00:27Z
Last modified2026-11-02
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.