SEC-042
Outdated jQuery with known XSS flaws
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Version numbers in script URLs, file names and library banner comments, against the jquery entries of the Retire.js vulnerability repository (fetched 2026-10-28). A bundle without a visible version is not judged.
Why it matters
jQuery before 3.5.0 can execute script hidden in HTML strings passed to .html(), .append() and similar methods, a common XSS path.
Recommended fix
Upgrade jQuery to 3.7 or later (add jQuery Migrate temporarily if old plugins break).
How to verify
Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-042: Outdated jQuery with known XSS flaws
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Upgrade jQuery to the latest 3.x release, update the script tag or package, and check pages that use plugins still work (use jQuery Migrate temporarily if needed).
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).