adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

vulnerable jquery version 1.11.3 in 2.9.5 #894

New Issue
Open
opened 2026-10-05 00:23:03 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:23:03 +02:00
Owner
Copy link
Copy source

Capture

default installation 2.9.5 have vulnerable jquery - https://snyk.io/vuln/npm:jquery?lh=1.11.3&utm_source=lighthouse&utm_medium=ref&utm_campaign=audit

![Capture](https://user-images.githubusercontent.com/41724273/58379873-2731eb80-7fb2-11e9-96cf-3753591a295f.PNG) default installation 2.9.5 have vulnerable jquery - https://snyk.io/vuln/npm:jquery?lh=1.11.3&utm_source=lighthouse&utm_medium=ref&utm_campaign=audit <!-- github-sync-id:448547504 -->
adam commented 2026-10-05 00:23:04 +02:00
Author
Owner
Copy link
Copy source

It seems we need to upgrade to the latest jQuery 3.x version to get this fixed. It will break Piwigo code in many parts, so I don't want to do it for Piwigo 2.10.

I don't know how problematic this vulnerability is. I may change my mind if I see a real problem related to it.

It seems we need to upgrade to the latest jQuery 3.x version to get this fixed. It will break Piwigo code in many parts, so I don't want to do it for Piwigo 2.10. I don't know how problematic this vulnerability is. I may change my mind if I see a real problem related to it. <!-- github-comment-id:504929518 -->
adam commented 2026-10-05 00:23:05 +02:00
Author
Owner
Copy link
Copy source

Adding this so you know how bad this can be, which isn't super bad but still concerning.
Our security scanning software, Nessus, picked up on this vulnerability in the current version of the default theme.
It pointed to CVE-2020-11022 which states that jquery allows for untrusted code to be executed in versions 1.2 and later and before version 3.5.0. It is fixed in version 3.5.0 and later.

Adding this so you know how bad this can be, which isn't super bad but still concerning. Our security scanning software, Nessus, picked up on this vulnerability in the current version of the default theme. It pointed to [CVE-2020-11022](https://nvd.nist.gov/vuln/detail/cve-2020-11022) which states that jquery allows for untrusted code to be executed in versions 1.2 and later and before version 3.5.0. It is fixed in version 3.5.0 and later. <!-- github-comment-id:1850253531 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#894