Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-6708 — Cross-site Scripting in Jquery

CWE-79 — Cross-site ScriptingCWE-64 — Windows Shortcut Following (.LNK)20 documents10 sources
Severity
6.1MEDIUMNVD
EPSS
0.9%
top 24.28%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Ruby-lang RubyJquery
Timeline
PublishedJan 18
Latest updateJul 8

Description

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploi…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶NVDjquery/jquery< 1.9.0
▶NuGetjquery/jquery< 1.9.0
▶npmjquery/jquery< 1.9.0
▶Ubuntujquery/jquery< 1.7.2+dfsg-2ubuntu1+esm1+2
▶Alpineruby-lang/ruby< 2.5.6-r0

Patches

Patch: github.com ↗Patch: snyk.io ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
jquery vulnerabilities↗2025-07-08
▶
GHSA
Cross-Site Scripting in jquery↗2020-09-01
▶
OSV
Cross-Site Scripting in jquery↗2020-09-01
▶
OSV
CVE-2012-6708: jQuery before 1↗2018-01-18
▶
CVEList
CVE-2012-6708: jQuery before 1↗2018-01-18
▶

💥Exploits & PoCs

1
Exploit-DB
Linksys EA7500 2.0.8.194281 - Cross-Site Scripting↗2021-03-25
▶

📋Vendor Advisories

3
Ubuntu
jQuery vulnerabilities↗2025-07-08
▶
Microsoft
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions jQuery d↗2018-01-09
▶
Red Hat
js-jquery: XSS via improper selector detection↗2017-03-21
▶

💬Community

10
HackerOne
Ruby is shipping a vulnerable jQuery↗2019-10-03
▶
Bugzilla
CVE-2012-6708 python-XStatic-jQuery: js-jquery: XSS via improper selector detection [fedora-all]↗2018-06-15
▶
Bugzilla
CVE-2012-6708 python-XStatic-jQuery: js-jquery: XSS via improper selector detection [epel-7]↗2018-06-15
▶
Bugzilla
CVE-2012-6708 rubygem-jquery-rails: js-jquery: XSS via improper selector detection [fedora-all]↗2018-06-15
▶
Bugzilla
CVE-2012-6708 js-jquery: XSS via improper selector detection↗2018-06-15
▶
CVE-2012-6708 — Cross-site Scripting in Jquery | cvebase