jQuery: version with known vulnerabilities

best_practices.vulnerable_libraries.jquery

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, vulnerable libraries

What the rule checks

Scope. Applies to pages on which the library is detected: its window global (with its version field) or, for jQuery, Bootstrap, AngularJS, Lodash and Handlebars, a script URL whose path names the library and a version.

Expectation. Fails for every jQuery below 3.5.0 (from 1.0.3 by CVE-2020-11023, below 3.0.0 also by CVE-2015-9251); 3.5.0 and later pass. Detected through `jQuery.fn.jquery`, the `$` alias alone, or a script path naming the core build (jquery-3.6.0.min.js, /jquery/3.6.0/jquery.min.js, jquery@3.6.0). A plugin named after jQuery (jquery-ui, jquery.validate) is not jQuery and its version is not jQuery's; the host part of a URL (127.0.0.1) is never a version. A page without the library: not applicable. A page that breaks the detection scripts (result missing or malformed) is not run for every library, never clean.

Source. retire.js jsrepository-v4.json (GitHub/NVD advisories), reviewed 2026-11-02 against NVD and GitHub advisories; CVE-2020-11022 (1.12.0 to < 3.5.0), CVE-2020-11023 (1.0.3 to < 3.5.0), CVE-2015-9251 (< 3.0.0)

Detection: analyze_vulnerable_libraries; needs dom.

Failing example

The check reports a violation here. Corpus case vulnerable_libs_dollar_alias. The page may contain further findings for other rules.

vulnerable_libs_dollar_alias.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>jQuery only as $, Bootstrap via attribute</title>
  <script>
    // jQuery.noConflict() hands back `jQuery`; some pages keep only `$`.
    window.$ = { fn: { jquery: "3.4.1" } };
    // AngularJS is end of life: even its last release is flagged.
    window.angular = { version: { full: "1.8.3" } };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>jQuery only as $, Bootstrap via attribute</h1>
    <div data-bs-version="4.0.0"></div>
  </main>
</body>
</html>

Passing example

The check passes here and reports nothing. Corpus case vulnerable_libs_boundaries_first_safe. The page may contain further findings for other rules.

vulnerable_libs_boundaries_first_safe.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>First fixed releases</title>
  <script>
    window.jQuery = { fn: { jquery: "3.5.0" } };
    window.bootstrap = { Tooltip: { VERSION: "4.3.1" } };
    window.Handlebars = { VERSION: "4.7.10" };
    window._ = { VERSION: "4.18.0", runInContext: function () {} };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>First fixed releases</h1>

  </main>
</body>
</html>

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.