CVE-2019-11358 PoC — jQuery 跨站脚本漏洞

Source

https://github.com/bitnesswise/jquery-prototype-pollution-fix

Associated Vulnerability

Title: jQuery 跨站脚本漏洞 (CVE-2019-11358)
Description:jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Description

A fix for CVE-2019-11358 (prototype pollution in jquery)

Readme

# jquery-prototype-pollution-fix
A fix for CVE-2019-11358 (prototype pollution in jquery)

Simply download and include **jquery-1.12.2-patched.js** into your project instead of the original 1.12.2 version.

See test folder for examples how to check for the vulnerability

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →