Outdated jQuery Library Allows Malicious Scripts to Run in Your Web App

Vulnerability Explanation

In jQuery versions >= 1.8.0 and < 2.2.0, the jQuery.parseHTML() function uses the active document context when parsing HTML strings. This causes inline event handler attributes (e.g., onerror, onload) embedded in the HTML to be executed immediately during parsing — before the caller has any opportunity to inspect or sanitize the result. An attacker who can supply HTML to any code path that calls $.parseHTML() (or implicitly triggers it via $(), .html(), .append(), etc.) can execute arbitrary JavaScript in the victim's browser.

Root Cause

The root cause is that jQuery.parseHTML() used document as the default parsing context. Browsers execute inline event handlers (like onerror on an <img> tag) as soon as the element is created in the live document context. The fix, introduced in jQuery 1.12.0 / 2.2.0, switched the default parsing context to document.implementation.createHTMLDocument(), which is an inert document that does not trigger script execution during parsing.

Technical Impact

Cross-site scripting (XSS): an attacker can execute arbitrary JavaScript in the context of the victim's browser session. This enables session token theft, account takeover, keylogging, UI redressing, or forced actions on behalf of the authenticated user. Exploitability depends on whether the application passes attacker-controlled HTML to jQuery's parsing or DOM manipulation methods.

Severity Justification

Network-accessible, requires user interaction and attacker-controlled HTML input to reach the vulnerable code path. CVSS 3.x base score for CVE-2015-9251 is in the medium range (6.1), with low confidentiality and integrity impact and changed scope due to browser-context execution.

Affected Components

• jQuery >= 1.8.0 and < 2.2.0

Remediation Steps

1. Upgrade jQuery to version 3.7.x (recommended) or at minimum 1.12.x / 2.2.x. The parseHTML() fix was introduced in 1.12.0 and 2.2.0. Note: versions 1.12.x and 2.2.x are themselves end-of-life and carry additional known vulnerabilities — prefer jQuery 3.7.x.
2. If using npm/yarn, update your package.json: run `npm install jquery@latest` or `yarn add jquery@latest`, then rebuild your bundle.
3. If loading jQuery from a CDN script tag, update the URL to point to the current stable release (e.g., https://code.jquery.com/jquery-3.7.1.min.js).
4. After upgrading, use the jQuery Migrate plugin (https://github.com/jquery/jquery-migrate) to detect any deprecated API usage that may break after the version jump.
5. Audit any code that passes user-supplied or externally fetched strings to $.parseHTML(), $(), .html(), .append(), or .replaceWith() — ensure those inputs are either trusted or sanitized with a dedicated library such as DOMPurify before being passed to jQuery.

Verification Steps

1. Run `npm list jquery` or check your built bundle to confirm the resolved jQuery version is 3.7.x or later.
2. Open browser DevTools on your application, run `jQuery.fn.jquery` in the console, and confirm the version string is 3.7.x or later.
3. Use Retire.js (https://retirejs.github.io/retire.js/) or a browser extension to scan your site and confirm no vulnerable jQuery version is detected.
4. Test the fix manually: if $.parseHTML('<img src=x onerror=alert(1)>') no longer triggers an alert, the patch is effective.

Code Examples (html)

<!-- Vulnerable: jQuery 1.11.0 loaded from CDN -->
<script src="https://code.jquery.com/jquery-1.11.0.min.js"></script>

// This executes the onerror handler immediately during parsing:
var nodes = $.parseHTML('<img src=x onerror="stealCookies()">');
$('body').append(nodes);

<!-- Fixed: jQuery 3.7.1 -->
<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>

// In jQuery 3.x, parseHTML uses an inert document context —
// inline event handlers are NOT executed during parsing.
// For additional safety, sanitize untrusted HTML before parsing:
import DOMPurify from 'dompurify';
var safeHtml = DOMPurify.sanitize(untrustedInput);
$('body').append($.parseHTML(safeHtml));

Best Practices

• Always sanitize untrusted HTML with a dedicated library (e.g., DOMPurify) before passing it to any jQuery DOM manipulation method, regardless of jQuery version.
• Pin and regularly audit third-party JavaScript dependencies using tools like Retire.js, npm audit, or Dependabot.
• Implement a Content Security Policy (CSP) header to limit the impact of any XSS that does occur — even a basic policy blocking inline scripts significantly reduces blast radius.
• Prefer jQuery 3.x for all new and existing projects; the 1.x and 2.x branches are end-of-life and no longer receive security patches.

References

• nvd.nist.gov/vuln/detail/CVE-2015-9251
• bugs.jquery.com/ticket/11974
• blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
• github.com/jquery/jquery-migrate
• research.insecurelabs.org/jquery/test/