Which security issues have affected jQuery, and how do you protect a legacy site?

Summary

Notable issues: XSS through HTML passed to DOM-manipulation methods in versions before 3.5.0 (CVE-2020-11022 and CVE-2020-11023, around htmlPrefilter), prototype pollution in $.extend(true, ...) before 3.4.0 (CVE-2019-11358), and older XSS issues in selector handling and cross-domain AJAX. Many sites still load vulnerable versions.

Longer Answer

Protection: upgrade to the latest jQuery 3.x, check plugins too (they often bundle old copies), never pass untrusted strings to .html(), $(html) or .append(), add a Content Security Policy, and scan dependencies regularly (npm audit, Retire.js, Snyk, or the browser extension that flags vulnerable libraries). Penetration testers and automated scanners flag old jQuery versions immediately.

Key Points

• XSS fixes in 3.5.0; prototype pollution fix in 3.4.0.
• Upgrade jQuery and plugins.
• No untrusted HTML into DOM methods.
• CSP and dependency scanning.

Deep dive: Code Clinic: review a jQuery shopping cart script