Cross-Site Scripting (XSS)

Overview

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain the dataType option.

Recommendation

Update to version 3.0.0 or later.

References

• Issue #2432
• Commit #b078a62
• PR #2588
• GitHub Advisory