CVE-2020-11023: 
JavaScript vulnerability analysis and mitigation

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This vulnerability was discovered in April 2020 and is tracked as CVE-2020-11023. The issue affects multiple versions of jQuery and has been patched in jQuery 3.5.0 (jQuery Blog, NVD).

The vulnerability exists in jQuery's DOM manipulation methods when handling HTML containing elements. Even after sanitizing the HTML input, passing it to methods like .html(), .append() and others could still result in execution of untrusted code. The issue affects jQuery's htmlPrefilter method which is used to process HTML before insertion into the DOM. The CVSS v3.1 base score is 6.1 (Medium severity) indicating network vector, low attack complexity, and requiring user interaction (GitHub Advisory).

A successful exploit could allow an attacker to execute arbitrary JavaScript code in the context of the web application using the vulnerable jQuery version. This could potentially lead to cross-site scripting (XSS) attacks even when proper HTML sanitization is performed before passing content to jQuery's DOM manipulation methods (NVD).

The recommended mitigation is to upgrade to jQuery version 3.5.0 or later which contains the fix for this vulnerability. For cases where upgrading is not immediately possible, using DOMPurify with its SAFE_FOR_JQUERY option is recommended to sanitize HTML strings before passing them to jQuery methods. The jQuery migrate plugin can also be used to restore the old behavior if needed by calling jQuery.UNSAFE_restoreLegacyHtmlPrefilter() (jQuery Blog).

The vulnerability received significant attention from the security community and affected many popular frameworks and applications that use jQuery. Multiple vendors including Drupal, Oracle, and others released security advisories and patches for their products to address this vulnerability. The issue was considered serious enough to warrant emergency updates in several cases (Drupal SA).