Outdated jQuery Library Can Run Malicious Code in Visitors' Browsers

Vulnerability Explanation

In jQuery versions prior to 3.0.0, when a cross-origin AJAX request is made without an explicit `dataType` option, jQuery inspects the response's Content-Type header. If the server returns `text/javascript`, jQuery automatically passes the response body to `jQuery.globalEval()`, executing it in the global scope. An attacker who controls or can influence the response from a cross-origin endpoint — for example, a compromised CDN, API, or third-party service — can inject arbitrary JavaScript that executes in the victim's browser within the context of the originating page. Exploitation requires user interaction (visiting the affected page) and a cross-origin request to an attacker-influenced endpoint, making this a realistic but conditional attack vector.

Root Cause

jQuery lacked strict response type enforcement for cross-origin AJAX requests. When `dataType` was omitted, jQuery performed content-type sniffing and treated `text/javascript` responses as executable code, invoking `jQuery.globalEval()` without any sanitisation or user consent. This behaviour was corrected in jQuery 3.0.0, which no longer auto-executes cross-domain script responses.

Technical Impact

An attacker controlling a cross-origin endpoint targeted by the vulnerable jQuery AJAX call can execute arbitrary JavaScript in the victim's browser session. This enables session hijacking via cookie theft, DOM manipulation, credential harvesting via fake UI overlays, and redirection to malicious sites — all within the security context of the hosting page.

Severity Justification

CVSS 3.0 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Network-accessible, no privileges required, but requires user interaction and a cross-origin request to an attacker-influenced endpoint. Impact is limited to confidentiality and integrity with no availability impact.

Affected Components

• jQuery >= 1.0.0 and < 3.0.0

Remediation Steps

1. Upgrade jQuery to version 3.0.0 or later. This is the definitive fix — the auto-execution of cross-domain `text/javascript` responses was removed in 3.0.0. If migrating from 1.x, review the jQuery 3.0 upgrade guide for breaking changes.
2. If an immediate upgrade is not feasible, audit all `$.ajax()`, `$.get()`, and `$.post()` calls that target cross-origin URLs and add an explicit `dataType` option (e.g. `dataType: 'json'`). This prevents jQuery from treating the response as executable script.
3. Remove any jQuery loaded from third-party CDNs without Subresource Integrity (SRI) checks, or add SRI hashes to existing CDN `<script>` tags to prevent CDN-served script tampering.
4. Deploy a Content Security Policy (CSP) header with a restrictive `script-src` directive as a defence-in-depth measure to limit the impact of any script injection.

Verification Steps

1. Run `curl -s https://yoursite.com | grep -i 'jquery'` or inspect the page source to confirm the loaded jQuery version is 3.0.0 or later.
2. Use Retire.js CLI (`retire --path ./your-project`) or the Retire.js browser extension to scan for known vulnerable library versions.
3. Check all cross-origin AJAX calls in your codebase: `grep -rn 'dataType' src/` — any `$.ajax` call targeting an external URL without `dataType` should be reviewed.
4. Validate your CSP header using https://csp-evaluator.withgoogle.com/ after deployment.

Code Examples (javascript)

// No dataType specified — jQuery will sniff Content-Type and may execute text/javascript responses
$.ajax({
  url: 'https://api.third-party.com/data',
  success: function(data) {
    console.log(data);
  }
});

// Explicit dataType prevents auto-execution of script responses
$.ajax({
  url: 'https://api.third-party.com/data',
  dataType: 'json',  // Enforce expected response type
  success: function(data) {
    console.log(data);
  }
});

// Better yet: upgrade to jQuery 3.x and use the Fetch API or $.ajax with dataType
// jQuery 3.x CDN with SRI:
// <script
//   src="https://code.jquery.com/jquery-3.7.1.min.js"
//   integrity="sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo="
//   crossorigin="anonymous"></script>

Best Practices

• Always specify `dataType` explicitly in jQuery AJAX calls to cross-origin endpoints — never rely on content-type sniffing.
• Add Subresource Integrity (SRI) hashes to all third-party `<script>` and `<link>` tags loaded from CDNs.
• Implement a Content Security Policy with a strict `script-src` directive to limit script execution to trusted origins.
• Integrate Retire.js or a similar SCA tool into your CI/CD pipeline to catch vulnerable JavaScript library versions before they reach production.

References

• nvd.nist.gov/vuln/detail/cve-2015-9251
• security.snyk.io/vuln/npm:jquery:20150627
• github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b5f
• www.cvedetails.com/cve/CVE-2015-9251/