jquery-rails 3.1.4
Potential XSS vulnerability in jQuery
high severity CVE-2020-11023>= 4.4.0
Impact
Passing HTML containing <option> elements from untrusted sources - even after
sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(),
.append(), and others) may execute untrusted code.
Workarounds
To workaround this issue without upgrading, use DOMPurify with its
SAFE_FOR_JQUERY option to sanitize the HTML string before passing it to a
jQuery method.
Potential XSS vulnerability in jQuery
high severity CVE-2020-11022>= 3.5.0
< 1.2.0
Impact
Passing HTML from untrusted sources - even after sanitizing it - to
one of jQuery's DOM manipulation methods (i.e. .html(), .append(),
and others) may execute untrusted code.
Patches
This problem is patched in jQuery 3.5.0.
Workarounds
To workaround the issue without upgrading, adding the following to your code:
jQuery.htmlPrefilter = function( html ) {
return html;
};
You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.
References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/
For more information
If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo.
If you don't find an answer, open a new issue."
Prototype pollution attack through jQuery $.extend
medium severity CVE-2019-11358>= 4.3.4
jQuery before 3.4.0 mishandles jQuery.extend(true, {}, ...) because of bject.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
Cross-Site Scripting (XSS) in jquery
medium severity CVE-2015-9251>= 4.2.0
Affected versions of jquery interpret text/javascript responses
from cross-origin ajax requests, and automatically execute the
contents in jQuery.globalEval, even when the ajax request
doesn't contain the dataType option.
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
No license issues detected.
This gem version has a license in the gemspec.
This gem version is available.
This gem version has not been yanked and is still available for usage.