{"id":"CVE-2019-11358","published":"2019-04-19T00:00:00Z","modified":"2024-11-15T15:11:23Z","title":"jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...)…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in jQuery versions before 3.4.0, as bundled in products such as Drupal and Backdrop CMS, where the jQuery.extend(true, {}, ...) deep-merge function mishandles Object.prototype pollution. An attacker who can supply an unsanitized source object containing an enumerable __proto__ property can extend the native Object.prototype, with the exact conditions of exposure depending on whether the application passes untrusted input into that function.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:37Z"},"cvss":null,"epss":{"score":0.8682,"percentile":0.99743,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-01-21","exploitedFirstSeen":"2021-01-21","ransomware":false,"evidence":[{"url":"https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts","date":"2021-01-21"},{"url":"https://www.securin.io/wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf","date":"2023-08-08"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"clone school board","url":"https://otx.alienvault.com/pulse/69a9cad78745fdea3001aec9","created":"2026-03-05"},{"name":"clone school board","url":"https://otx.alienvault.com/pulse/69a9cad6633206ba1204cf8f","created":"2026-03-05"},{"name":"http://crd.gov.pl/wzor/","url":"https://otx.alienvault.com/pulse/66a27442c3dd6aa438bd8d67","created":"2024-07-25"},{"name":"recallsfschoolboard.org","url":"https://otx.alienvault.com/pulse/65707e9819da1f2e8e26e78e","created":"2023-12-06"},{"name":"recallsfschoolboard.org","url":"https://otx.alienvault.com/pulse/6211397913dcdae410959042","created":"2022-02-19"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.drupal.org/sa-core-2019-006","tags":[]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_19","tags":[]},{"url":"https://www.debian.org/security/2019/dsa-4434","tags":["vendor-advisory"]},{"url":"https://seclists.org/bugtraq/2019/Apr/32","tags":["mailing-list"]},{"url":"http://www.securityfocus.com/bid/108023","tags":["vdb-entry"]},{"url":"https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5/","tags":["vendor-advisory"]},{"url":"https://seclists.org/bugtraq/2019/May/18","tags":["mailing-list"]},{"url":"http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html","tags":[]},{"url":"http://seclists.org/fulldisclosure/2019/May/11","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2019/May/10","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2019/May/13","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/03/2","tags":["mailing-list"]},{"url":"http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2019:1456","tags":["vendor-advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4460","tags":["vendor-advisory"]},{"url":"https://seclists.org/bugtraq/2019/Jun/12","tags":["mailing-list"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2019:1570","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E","tags":["mailing-list"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2587","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190919-0001/","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2019:3023","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3024","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list"]},{"url":"https://www.tenable.com/security/tns-2019-08","tags":[]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html","tags":["mailing-list"]},{"url":"http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html","tags":[]},{"url":"https://www.tenable.com/security/tns-2020-02","tags":[]},{"url":"https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E","tags":["mailing-list"]},{"url":"https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E","tags":["mailing-list"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":[]},{"url":"https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E","tags":["mailing-list"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":[]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":[]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":[]},{"url":"https://backdropcms.org/security/backdrop-sa-core-2019-009","tags":[]},{"url":"https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/","tags":[]},{"url":"https://snyk.io/vuln/SNYK-JS-JQUERY-174006","tags":[]},{"url":"https://github.com/jquery/jquery/pull/4333","tags":[]},{"url":"https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b","tags":[]},{"url":"https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery/","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":[]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":[]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":[]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":[]},{"url":"https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","tags":["mailing-list"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"jquery","vulnerableRanges":[">=1.1.4, <3.4.0"],"patched":["3.4.0"],"from":["GHSA-6c3j-c64m-qhgq"],"provenance":"source"},{"ecosystem":"RubyGems","package":"jquery-rails","vulnerableRanges":["<4.3.4"],"patched":["4.3.4"],"from":["GHSA-6c3j-c64m-qhgq"],"provenance":"source"},{"ecosystem":"NuGet","package":"jQuery","vulnerableRanges":[">=1.1.4, <3.4.0"],"patched":["3.4.0"],"from":["GHSA-6c3j-c64m-qhgq"],"provenance":"source"},{"ecosystem":"PyPI","package":"django","vulnerableRanges":[">=2.0a1, <2.1.9",">=2.2a1, <2.2.2"],"patched":["2.1.9","2.2.2"],"from":["GHSA-6c3j-c64m-qhgq","PYSEC-2026-628"],"provenance":"source"},{"ecosystem":"Maven","package":"org.webjars.npm:jquery","vulnerableRanges":[">=1.1.4, <3.4.0"],"patched":["3.4.0"],"from":["GHSA-6c3j-c64m-qhgq"],"provenance":"source"},{"ecosystem":"Packagist","package":"maximebf/debugbar","vulnerableRanges":["<1.19.0"],"patched":["1.19.0"],"from":["GHSA-6c3j-c64m-qhgq"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <8.5.15",">=8.6.0, <8.6.15"],"patched":["8.5.15","8.6.15"],"from":["DRUPAL-CORE-2019-006"],"provenance":"source"}],"advisories":[{"id":"GHSA-6c3j-c64m-qhgq","url":"https://github.com/advisories/GHSA-6c3j-c64m-qhgq","severity":"MODERATE","ecosystem":"npm","package":"jquery","vulnerableRanges":[">=1.1.4, <3.4.0"],"patched":["3.4.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6c3j-c64m-qhgq","url":"https://github.com/advisories/GHSA-6c3j-c64m-qhgq","severity":"MODERATE","ecosystem":"RubyGems","package":"jquery-rails","vulnerableRanges":["<4.3.4"],"patched":["4.3.4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6c3j-c64m-qhgq","url":"https://github.com/advisories/GHSA-6c3j-c64m-qhgq","severity":"MODERATE","ecosystem":"NuGet","package":"jQuery","vulnerableRanges":[">=1.1.4, <3.4.0"],"patched":["3.4.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6c3j-c64m-qhgq","url":"https://github.com/advisories/GHSA-6c3j-c64m-qhgq","severity":"MODERATE","ecosystem":"PyPI","package":"django","vulnerableRanges":[">=2.0a1, <2.1.9"],"patched":["2.1.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6c3j-c64m-qhgq","url":"https://github.com/advisories/GHSA-6c3j-c64m-qhgq","severity":"MODERATE","ecosystem":"PyPI","package":"django","vulnerableRanges":[">=2.2a1, <2.2.2"],"patched":["2.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6c3j-c64m-qhgq","url":"https://github.com/advisories/GHSA-6c3j-c64m-qhgq","severity":"MODERATE","ecosystem":"Maven","package":"org.webjars.npm:jquery","vulnerableRanges":[">=1.1.4, <3.4.0"],"patched":["3.4.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6c3j-c64m-qhgq","url":"https://github.com/advisories/GHSA-6c3j-c64m-qhgq","severity":"MODERATE","ecosystem":"Packagist","package":"maximebf/debugbar","vulnerableRanges":["<1.19.0"],"patched":["1.19.0"],"provenance":"source","from":"GHSA"},{"id":"DRUPAL-CORE-2019-006","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2019-006","severity":null,"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <8.5.15",">=8.6.0, <8.6.15"],"patched":["8.5.15","8.6.15"],"provenance":"source","from":"OSV"}],"euvd":{"id":"EUVD-2019-0403","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0403","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52141,"url":"https://www.exploit-db.com/exploits/52141","title":"jQuery 3.3.1 - Prototype Pollution & XSS Exploit","type":"webapps","platform":"multiple","date":"2025-04-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-08"},"pocGithub":{"count":6,"skipped":0,"earliest":"2019-03-30","earliestUrl":"https://github.com/DanielRuf/snyk-js-jquery-174006","repos":[{"name":"chrisneagu/FTC-Skystone-Dark-Angels-Romania-2020","url":"https://github.com/chrisneagu/FTC-Skystone-Dark-Angels-Romania-2020","stars":320,"created":"2021-03-08"},{"name":"DanielRuf/snyk-js-jquery-174006","url":"https://github.com/DanielRuf/snyk-js-jquery-174006","stars":28,"created":"2019-03-30"},{"name":"DanielRuf/snyk-js-jquery-565129","url":"https://github.com/DanielRuf/snyk-js-jquery-565129","stars":27,"created":"2020-04-14"},{"name":"bitnesswise/jquery-prototype-pollution-fix","url":"https://github.com/bitnesswise/jquery-prototype-pollution-fix","stars":6,"created":"2019-07-18"},{"name":"isacaya/CVE-2019-11358","url":"https://github.com/isacaya/CVE-2019-11358","stars":1,"created":"2023-08-05"}]},"first":{"date":"2019-03-30","source":"PoC-in-GitHub","url":"https://github.com/DanielRuf/snyk-js-jquery-174006"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html","http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html","http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html"],"flow":[],"timeline":[{"date":"2019-03-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-04-08","url":"https://github.com/DanielRuf/snyk-js-jquery-174006","provenance":"source"},{"date":"2019-04-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-11358","provenance":"source"},{"date":"2021-01-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":61.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2108 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9974"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 3 NVD exploit links; 6 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-jquery-cve-2012-6708","parents":[{"from":"CVE-2012-6708","to":"CVE-2019-11358","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/core.js"],"commits":["https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d","https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2019-11358","to":"CVE-2020-7656","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/core.js"],"commits":["https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b","https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2016-10707","published":"2018-01-18","fixed":"3.0.0","kev":false},{"cve":"CVE-2015-1840","published":"2015-07-26","fixed":"4.0.4","kev":false},{"cve":"CVE-2015-9251","published":"2018-01-18","fixed":"4.2.0","kev":false,"link":{"from":"CVE-2015-9251","to":"CVE-2019-11358","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:jquery-rails","fromFixed":"4.2.0","toFixed":"4.3.4","daysApart":456},{"kind":"version-step","provenance":"source","package":"npm:jquery","fromFixed":"3.0.0","toFixed":"3.4.0","daysApart":456}]}},{"cve":"CVE-2019-11358","published":"2019-04-19","fixed":"4.3.4","kev":false},{"cve":"CVE-2020-11022","published":"2020-04-29","fixed":"4.4.0","kev":false,"link":{"from":"CVE-2019-11358","to":"CVE-2020-11022","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:jquery-rails","fromFixed":"4.3.4","toFixed":"4.4.0","daysApart":376},{"kind":"version-step","provenance":"source","package":"npm:jquery","fromFixed":"3.4.0","toFixed":"3.5.0","daysApart":376}]}},{"cve":"CVE-2020-11023","published":"2020-04-29","fixed":"4.4.0","kev":true,"link":{"from":"CVE-2019-11358","to":"CVE-2020-11023","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:jquery-rails","fromFixed":"4.3.4","toFixed":"4.4.0","daysApart":376},{"kind":"version-step","provenance":"source","package":"npm:jquery","fromFixed":"3.4.0","toFixed":"3.5.0","daysApart":376}]}}],"package":"RubyGems:jquery-rails"}}