Media

Use of insecure jQuery version in OctoberCMS

Publicada: 05.06.2020
Actualizado: 11.10.2026 10:22

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

Workarounds

Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.

References

For more information

If you have any questions or comments about this advisory:

Email us at octobercms@luketowers.ca & hello@octobercms.com

Threat Assessment

Assessed as Moderate by the @jquery team.

Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	october/october	>= 1.0.319, < 1.0.466	1.0.466
Paquete de Composer	october/system	>= 1.0.319, < 1.0.466	1.0.466

Referencias

Puntuación CVSS -

Debilidad (CWE): -
Plataforma: Composer
Paquete: october/october, october/system
Publicada: 05.06.2020
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-v73w-r9xg-7cr9 - CC BY 4.0

Historial de vulnerabilidades: october/system

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (25) en el archivo

Entradas en total: 25
Primera → última: 06.2020 09.2026
Sin corrección: 0
Explotada en ataques: 1

Distribución por gravedad

Crítica 1
Alta 8
Media 9
Baja 7

Divulgaciones por año

2020: 1
2021: 3
2022: 6
2023: 3
2024: 2
2025: 1
2026: 9

29.11.2023

October CMS safe mode bypass using Twig sandbox escape

Crítica · 9.1 CVE-2023-44382 >= 3.0.0, < 3.4.15 3.4.15
13.10.2022

October CMS Safe Mode bypass leads to authenticated Remote Code Execution

Alta · 7.2 CVE-2022-35944 >= 2.0.0, < 2.2.34, >= 3.0.0, < 3.0.66 2.2.34, 3.0.66
13.07.2022

October CMS upload process vulnerable to RCE via Race Condition

Alta · 8.1 CVE-2022-24800 < 1.0.476, >= 1.1.0, < 1.1.12, >= 2.0.0, < 2.2.15 1.0.476, 1.1.12, 2.2.15
23.02.2022

Authenticated remote code execution in October CMS

Alta · 7.2 CVE-2022-21705 < 1.0.474, >= 1.1.0, < 1.1.10, >= 2.0.0, < 2.1.27 1.0.474, 1.1.10, 2.1.27
14.01.2022

october/system arbitrary code execution

Alta · 8.8 CVE-2021-32650 >= 1.1.0, < 1.1.6, < 1.0.473 1.1.6, 1.0.473
14.01.2022

October/System authenticated file write leads to remote code execution

Alta · 8.8 CVE-2021-32649 >= 1.1.0, < 1.1.6, < 1.0.473 1.1.6, 1.0.473
06.10.2021

Deleted Admin Can Sign In to Admin Interface

Alta · 7.2 CVE-2021-41126 >= 2.1.0, < 2.1.12 2.1.12
30.08.2021

October CMS auth bypass and account takeover

Alta · 7.4 CVE-2021-29487 < 1.0.472, >= 1.1.1, < 1.1.5 1.0.472, 1.1.5
30.08.2021

Account Takeover in Octobercms

Alta · 8.2 Explotada en ataques CVE-2021-32648 < 1.0.472, >= 1.1.1, < 1.1.5 1.0.472, 1.1.5
05.06.2020

Use of insecure jQuery version in OctoberCMS esta entrada

Media ghsa-v73w-r9xg-7cr9 >= 1.0.319, < 1.0.466 1.0.466

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación