Use of insecure jQuery version in OctoberCMS
Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.
Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.
References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/
For more information
If you have any questions or comments about this advisory:
- Email us at octobercms@luketowers.ca & hello@octobercms.com
Threat Assessment
Assessed as Moderate by the @jquery team.
Acknowledgements
Thanks to @mrgswift for reporting the issue to the October CMS team.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | october/october | >= 1.0.319, < 1.0.466 | 1.0.466 |
| Composer package | october/system | >= 1.0.319, < 1.0.466 | 1.0.466 |
References
- Weakness (CWE)
-- Platform
- Composer
- Package
october/october, october/system- Disclosed
- 05.06.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v73w-r9xg-7cr9 - CC BY 4.0
Vulnerability history: october/october
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 13
- First → latest
- 06.2020 09.2026
- Without a fix
- 3
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 4
- Medium 5
- Low 3
Disclosures per year
- 2020: 1
- 2021: 1
- 2022: 5
- 2023: 1
- 2024: 2
- 2025: 1
- 2026: 2
-
Use of insecure jQuery version in OctoberCMS this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.