GHSA-fj93-7wm4-8x2g: 
JavaScript vulnerability analysis and mitigation

All versions of jQuery Mobile (JQM) are vulnerable to Cross-Site Scripting (XSS) via crafted URLs, identified as GHSA-fj93-7wm4-8x2g. The vulnerability was discovered in 2019 and affects all versions of the library. The issue stems from the package's handling of content in location.hash and its subsequent processing of XHR responses (GitHub Advisory, Snyk Report).

The vulnerability occurs when the package checks for content in location.hash and if a URL is found, it performs an XMLHttpRequest (XHR) to the URL and renders the response with innerHTML. The critical flaw is that it fails to validate the Content-Type of the response, which allows attackers to include malicious payloads as part of query parameters that are reflected back to the user. For example, a response such as {"q":"","results":[]} would be parsed as HTML and any embedded JavaScript payload would be executed (GitHub Advisory, Gist Details).

The vulnerability allows attackers to perform cross-site scripting attacks on applications using jQuery Mobile. In versions up to and including 1.2.1, the only requirement is that the library is included in a web application. For versions > 1.2.1, the web application must also contain a server-side API that reflects back user input as part of an HTTP response of any type (Gist Details).

The vulnerability is exploitable in two ways: First, through any same-origin URL that reflects back user input from a GET parameter, and second, through a broken URL parsing implementation that fails in basic forms of URL validation. The second technique specifically affects versions ≤ 1.2.1 and requires no server-side vulnerability (Gist Details).

No official patch is currently available as jQuery Mobile is no longer actively maintained. The recommended action is to migrate to an alternative framework. A fix was pushed to the master branch that includes Content-Type validation before parsing AJAX responses as HTML, but this was not officially released (GitHub PR, GitHub Advisory).