# CVE-2020-11022: jQuery has a potential XSS vulnerability

Status: published. Published: 2020-04-29. Updated: 2026-11-02.

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

## Remediation

- fix: jquery (npm): OSV reports a fixed version 3.5.0. Check the advisory for supported release branches. (source: OSV GHSA-gxr4-xjj5-5px2) — https://github.com/advisories/GHSA-gxr4-xjj5-5px2
- fix: jquery (NuGet): OSV reports a fixed version 3.5.0. Check the advisory for supported release branches. (source: OSV GHSA-gxr4-xjj5-5px2) — https://github.com/advisories/GHSA-gxr4-xjj5-5px2
- fix: jquery-rails (RubyGems): OSV reports a fixed version 4.4.0. Check the advisory for supported release branches. (source: OSV GHSA-gxr4-xjj5-5px2) — https://github.com/advisories/GHSA-gxr4-xjj5-5px2
- fix: org.webjars.npm:jquery (Maven): OSV reports a fixed version 3.5.0. Check the advisory for supported release branches. (source: OSV GHSA-gxr4-xjj5-5px2) — https://github.com/advisories/GHSA-gxr4-xjj5-5px2
- fix: maximebf/debugbar (Packagist): OSV reports a fixed version 1.19.0. Check the advisory for supported release branches. (source: OSV GHSA-gxr4-xjj5-5px2) — https://github.com/advisories/GHSA-gxr4-xjj5-5px2
- fix: athlon1600/youtube-downloader (Packagist): OSV reports a fixed version 4.0.1. Check the advisory for supported release branches. (source: OSV GHSA-gxr4-xjj5-5px2) — https://github.com/advisories/GHSA-gxr4-xjj5-5px2
- fix: components/jquery (Packagist): OSV reports a fixed version 3.5.0. Check the advisory for supported release branches. (source: OSV GHSA-gxr4-xjj5-5px2) — https://github.com/advisories/GHSA-gxr4-xjj5-5px2

## Affected products and versions

- jquery / jQuery: >= 1.12.0, < 3.5.0 (affected). Source: CNA: GitHub_M
-  / jquery (jquery): ≥ 1.12.0; < 3.5.0 (affected, semver); OSV events: introduced 1.12.0; fixed 3.5.0. Source: OSV GHSA-gxr4-xjj5-5px2
-  / jquery (jquery): 1.12.0 (affected, NuGet); 1.12.1 (affected, NuGet); 1.12.2 (affected, NuGet); 1.12.3 (affected, NuGet); 1.12.4 (affected, NuGet); 2.0.0 (affected, NuGet); 2.0.1 (affected, NuGet); 2.0.1.1 (affected, NuGet); 2.0.2 (affected, NuGet); 2.0.3 (affected, NuGet); 2.1.0 (affected, NuGet); 2.1.1 (affected, NuGet); 2.1.2 (affected, NuGet); 2.1.3 (affected, NuGet); 2.1.4 (affected, NuGet); 2.2.0 (affected, NuGet); 2.2.1 (affected, NuGet); 2.2.2 (affected, NuGet); 2.2.3 (affected, NuGet); 2.2.4 (affected, NuGet); 3.0.0 (affected, NuGet); 3.0.0.1 (affected, NuGet); 3.1.0 (affected, NuGet); 3.1.1 (affected, NuGet); 3.2.1 (affected, NuGet); 3.3.1 (affected, NuGet); 3.4.0 (affected, NuGet); 3.4.1 (affected, NuGet); Ecosystem version events: introduced 1.12.0; fixed 3.5.0. Source: OSV GHSA-gxr4-xjj5-5px2
-  / jquery-rails (jquery-rails): 0.1.1 (affected, RubyGems); 0.1.2 (affected, RubyGems); 0.1.3 (affected, RubyGems); 0.2 (affected, RubyGems); 0.2.1 (affected, RubyGems); 0.2.2 (affected, RubyGems); 0.2.3 (affected, RubyGems); 0.2.4 (affected, RubyGems); 0.2.5 (affected, RubyGems); 0.2.6 (affected, RubyGems); 0.2.7 (affected, RubyGems); 1.0 (affected, RubyGems); 1.0.1 (affected, RubyGems); 1.0.10 (affected, RubyGems); 1.0.11 (affected, RubyGems); 1.0.12 (affected, RubyGems); 1.0.13 (affected, RubyGems); 1.0.14 (affected, RubyGems); 1.0.15 (affected, RubyGems); 1.0.16 (affected, RubyGems); 1.0.17 (affected, RubyGems); 1.0.18 (affected, RubyGems); 1.0.19 (affected, RubyGems); 1.0.2 (affected, RubyGems); 1.0.3 (affected, RubyGems); 1.0.4 (affected, RubyGems); 1.0.5 (affected, RubyGems); 1.0.6 (affected, RubyGems); 1.0.7 (affected, RubyGems); 1.0.8 (affected, RubyGems); 1.0.9 (affected, RubyGems); 1.0.rc (affected, RubyGems); 2.0.1 (affected, RubyGems); 2.0.2 (affected, RubyGems); 2.0.3 (affected, RubyGems); 2.1.0 (affected, RubyGems); 2.1.1 (affected, RubyGems); 2.1.2 (affected, RubyGems); 2.1.3 (affected, RubyGems); 2.1.4 (affected, RubyGems); 2.2.0 (affected, RubyGems); 2.2.1 (affected, RubyGems); 2.2.2 (affected, RubyGems); 2.3.0 (affected, RubyGems); 3.0.0 (affected, RubyGems); 3.0.1 (affected, RubyGems); 3.0.2 (affected, RubyGems); 3.0.3 (affected, RubyGems); 3.0.4 (affected, RubyGems); 3.1.0 (affected, RubyGems); 3.1.1 (affected, RubyGems); 3.1.2 (affected, RubyGems); 3.1.3 (affected, RubyGems); 3.1.4 (affected, RubyGems); 3.1.5 (affected, RubyGems); 4.0.0 (affected, RubyGems); 4.0.0.beta1 (affected, RubyGems); 4.0.0.beta2 (affected, RubyGems); 4.0.1 (affected, RubyGems); 4.0.2 (affected, RubyGems); 4.0.3 (affected, RubyGems); 4.0.4 (affected, RubyGems); 4.0.5 (affected, RubyGems); 4.1.0 (affected, RubyGems); 4.1.1 (affected, RubyGems); 4.2.0 (affected, RubyGems); 4.2.1 (affected, RubyGems); 4.2.2 (affected, RubyGems); 4.3.0 (affected, RubyGems); 4.3.1 (affected, RubyGems); 4.3.2 (affected, RubyGems); 4.3.3 (affected, RubyGems); 4.3.4 (affected, RubyGems); 4.3.5 (affected, RubyGems); Ecosystem version events: introduced 0; fixed 4.4.0. Source: OSV GHSA-gxr4-xjj5-5px2
-  / org.webjars.npm:jquery (org.webjars.npm:jquery): 1.12.1 (affected, Maven); 1.12.2 (affected, Maven); 1.12.3 (affected, Maven); 1.12.4 (affected, Maven); 2.1.0 (affected, Maven); 2.1.1 (affected, Maven); 2.1.1-rc1 (affected, Maven); 2.1.1-rc2 (affected, Maven); 2.1.3 (affected, Maven); 2.1.4 (affected, Maven); 2.2.0 (affected, Maven); 2.2.1 (affected, Maven); 2.2.2 (affected, Maven); 2.2.3 (affected, Maven); 2.2.4 (affected, Maven); 3.0.0 (affected, Maven); 3.0.0-alpha1 (affected, Maven); 3.0.0-beta1 (affected, Maven); 3.0.0-rc1 (affected, Maven); 3.1.0 (affected, Maven); 3.1.1 (affected, Maven); 3.2.0 (affected, Maven); 3.2.1 (affected, Maven); 3.3.0 (affected, Maven); 3.3.1 (affected, Maven); 3.4.0 (affected, Maven); 3.4.1 (affected, Maven); Ecosystem version events: introduced 1.12.0; fixed 3.5.0. Source: OSV GHSA-gxr4-xjj5-5px2
-  / maximebf/debugbar (maximebf/debugbar): 1.0 (affected, Packagist); 1.0.1 (affected, Packagist); 1.0.2 (affected, Packagist); 1.0.3 (affected, Packagist); 1.0.4 (affected, Packagist); 1.1 (affected, Packagist); 1.10.0 (affected, Packagist); 1.10.1 (affected, Packagist); 1.13.1 (affected, Packagist); 1.2 (affected, Packagist); 1.3 (affected, Packagist); 1.4 (affected, Packagist); 1.5 (affected, Packagist); 1.5.1 (affected, Packagist); 1.6 (affected, Packagist); 1.6.1 (affected, Packagist); 1.7 (affected, Packagist); 1.7.1 (affected, Packagist); 1.8 (affected, Packagist); 1.9 (affected, Packagist); 1.9.1 (affected, Packagist); 1.9.10 (affected, Packagist); 1.9.11 (affected, Packagist); 1.9.12 (affected, Packagist); 1.9.13 (affected, Packagist); 1.9.14 (affected, Packagist); 1.9.15 (affected, Packagist); 1.9.2 (affected, Packagist); 1.9.3 (affected, Packagist); 1.9.4 (affected, Packagist); 1.9.5 (affected, Packagist); 1.9.6 (affected, Packagist); 1.9.7 (affected, Packagist); 1.9.8 (affected, Packagist); 1.9.9 (affected, Packagist); v1.10.2 (affected, Packagist); v1.10.3 (affected, Packagist); v1.10.4 (affected, Packagist); v1.10.5 (affected, Packagist); v1.11.0 (affected, Packagist); v1.11.1 (affected, Packagist); v1.12.0 (affected, Packagist); v1.13.0 (affected, Packagist); v1.14.0 (affected, Packagist); v1.14.1 (affected, Packagist); v1.15.0 (affected, Packagist); v1.15.1 (affected, Packagist); v1.16.0 (affected, Packagist); v1.16.1 (affected, Packagist); v1.16.2 (affected, Packagist); v1.16.3 (affected, Packagist); v1.16.4 (affected, Packagist); v1.16.5 (affected, Packagist); v1.17.0 (affected, Packagist); v1.17.1 (affected, Packagist); v1.17.2 (affected, Packagist); v1.17.3 (affected, Packagist); v1.18.0 (affected, Packagist); v1.18.1 (affected, Packagist); v1.18.2 (affected, Packagist); Ecosystem version events: introduced 0; fixed 1.19.0. Source: OSV GHSA-gxr4-xjj5-5px2
-  / athlon1600/youtube-downloader (athlon1600/youtube-downloader): v1.0.0 (affected, Packagist); v1.0.1 (affected, Packagist); v2.0.0 (affected, Packagist); v2.0.1 (affected, Packagist); v2.0.2 (affected, Packagist); v2.0.3 (affected, Packagist); v2.0.4 (affected, Packagist); v2.0.5 (affected, Packagist); v2.0.6 (affected, Packagist); v2.0.7 (affected, Packagist); v2.0.8 (affected, Packagist); v2.0.9 (affected, Packagist); v2.1.0 (affected, Packagist); v2.1.1 (affected, Packagist); v2.1.2 (affected, Packagist); v3.0.0 (affected, Packagist); v3.0.1 (affected, Packagist); v3.0.2 (affected, Packagist); v3.1.0 (affected, Packagist); v3.1.1 (affected, Packagist); v3.1.2 (affected, Packagist); v4.0.0 (affected, Packagist); Ecosystem version events: introduced 0; fixed 4.0.1. Source: OSV GHSA-gxr4-xjj5-5px2
-  / components/jquery (components/jquery): 1.12.0 (affected, Packagist); 1.12.1 (affected, Packagist); 1.12.4 (affected, Packagist); 2.0.0 (affected, Packagist); 2.0.1 (affected, Packagist); 2.0.2 (affected, Packagist); 2.0.3 (affected, Packagist); 2.1.0 (affected, Packagist); 2.1.1 (affected, Packagist); 2.1.3 (affected, Packagist); 2.1.4 (affected, Packagist); 2.2.0 (affected, Packagist); 2.2.1 (affected, Packagist); 2.2.4 (affected, Packagist); 3.0.0 (affected, Packagist); 3.1.0 (affected, Packagist); 3.1.1 (affected, Packagist); 3.2.0 (affected, Packagist); 3.2.1 (affected, Packagist); 3.3.1 (affected, Packagist); 3.4.1 (affected, Packagist); Ecosystem version events: introduced 1.12.0; fixed 3.5.0. Source: OSV GHSA-gxr4-xjj5-5px2

## Severity and prioritization

- CVSS 3.1: 6.9 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: 99.22% as of 2026-11-02; percentile 99.94%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/maximebf/php-debugbar/issues/447 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc (CNA: GitHub_M; x_refsource_MISC)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W (CNA: GitHub_M; x_refsource_MISC)

- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html (CNA: GitHub_M; x_refsource_MISC)

- https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html (CNA: GitHub_M; x_refsource_MISC)

- https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html (CNA: GitHub_M; x_refsource_MISC)

- https://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html (CNA: GitHub_M; x_refsource_MISC)

- https://security.gentoo.org/glsa/202007-03 (CNA: GitHub_M; x_refsource_MISC)

- https://www.debian.org/security/2020/dsa-4693 (CNA: GitHub_M; x_refsource_MISC)

- https://www.drupal.org/sa-core-2020-002 (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpuApr2021.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpuapr2022.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpujan2021.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpujan2022.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpujul2020.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpujul2021.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpujul2022.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpuoct2020.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.oracle.com/security-alerts/cpuoct2021.html (CNA: GitHub_M; x_refsource_MISC)

- https://www.tenable.com/security/tns-2020-10 (CNA: GitHub_M; x_refsource_MISC)

- https://www.tenable.com/security/tns-2020-11 (CNA: GitHub_M; x_refsource_MISC)

- https://www.tenable.com/security/tns-2021-02 (CNA: GitHub_M; x_refsource_MISC)

- https://www.tenable.com/security/tns-2021-10 (CNA: GitHub_M; x_refsource_MISC)

- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/jquery/jquery/releases/tag/3.5.0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-11022.yml (CNA: GitHub_M; x_refsource_MISC)

- https://jquery.com/upgrade-guide/3.5 (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2@%3Cissues.flink.apache.org%3E (CNA: GitHub_M; x_refsource_MISC)

- https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html (CNA: GitHub_M; x_refsource_MISC)

- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html (CNA: GitHub_M; x_refsource_MISC)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY (CNA: GitHub_M; x_refsource_MISC)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K (CNA: GitHub_M; x_refsource_MISC)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4 (CNA: GitHub_M; x_refsource_MISC)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B (CNA: GitHub_M; x_refsource_MISC)

- http://security.netapp.com/advisory/ntap-20200511-0006 (CNA: GitHub_M; x_refsource_MISC)

- https://www.debian.org/security/2020/dsa-4693 (ADP: CVE; vendor-advisory, x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/ (ADP: CVE; vendor-advisory, x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/ (ADP: CVE; vendor-advisory, x_transferred)

- https://www.oracle.com/security-alerts/cpujul2020.html (ADP: CVE; x_transferred)

- https://jquery.com/upgrade-guide/3.5/ (ADP: CVE; x_transferred)

- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 (ADP: CVE; x_transferred)

- https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77 (ADP: CVE; x_transferred)

- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ (ADP: CVE; x_transferred)

- https://security.netapp.com/advisory/ntap-20200511-0006/ (ADP: CVE; x_transferred)

- https://www.drupal.org/sa-core-2020-002 (ADP: CVE; x_transferred)

- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html (ADP: CVE; vendor-advisory, x_transferred)

- https://security.gentoo.org/glsa/202007-03 (ADP: CVE; vendor-advisory, x_transferred)

- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html (ADP: CVE; vendor-advisory, x_transferred)

- https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/ (ADP: CVE; vendor-advisory, x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/ (ADP: CVE; vendor-advisory, x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/ (ADP: CVE; vendor-advisory, x_transferred)

- https://www.oracle.com/security-alerts/cpuoct2020.html (ADP: CVE; x_transferred)

- https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html (ADP: CVE; vendor-advisory, x_transferred)

- https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://www.oracle.com/security-alerts/cpujan2021.html (ADP: CVE; x_transferred)

- https://www.tenable.com/security/tns-2020-11 (ADP: CVE; x_transferred)

- https://www.tenable.com/security/tns-2020-10 (ADP: CVE; x_transferred)

- https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html (ADP: CVE; mailing-list, x_transferred)

- https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://www.oracle.com/security-alerts/cpuApr2021.html (ADP: CVE; x_transferred)

- https://www.tenable.com/security/tns-2021-10 (ADP: CVE; x_transferred)

- https://www.tenable.com/security/tns-2021-02 (ADP: CVE; x_transferred)

- http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html (ADP: CVE; x_transferred)

- https://www.oracle.com//security-alerts/cpujul2021.html (ADP: CVE; x_transferred)

- https://www.oracle.com/security-alerts/cpuoct2021.html (ADP: CVE; x_transferred)

- https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E (ADP: CVE; mailing-list, x_transferred)

- https://www.oracle.com/security-alerts/cpujan2022.html (ADP: CVE; x_transferred)

- https://www.oracle.com/security-alerts/cpuapr2022.html (ADP: CVE; x_transferred)

- https://www.oracle.com/security-alerts/cpujul2022.html (ADP: CVE; x_transferred)

- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html (ADP: CVE; mailing-list, x_transferred)

- https://github.com/advisories/GHSA-gxr4-xjj5-5px2 (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-gxr4-xjj5-5px2 (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2020-11022; retrieved 2026-11-02; source updated 2026-11-02

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-gxr4-xjj5-5px2; retrieved 2026-11-02; source updated 2026-09-10

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2020-11022; retrieved 2026-11-02; source updated Not reported

Revision: 717f77428938bf6373f11082839dba3230315c323542496d98656a2ae9b0bf90

Canonical: https://y2.dev/cve/CVE-2020-11022

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.