VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 18, 2018· Updated Aug 6, 2024

CVE-2015-9251

CVE-2015-9251

Description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

jQuery before 3.0.0 executes script responses from cross-domain Ajax requests, enabling XSS attacks.

Vulnerability

jQuery versions prior to 3.0.0 are vulnerable to Cross-site Scripting (XSS) due to automatic execution of JavaScript responses when performing a cross-domain Ajax request without explicitly specifying the dataType option. In such cases, jQuery incorrectly treats text/javascript responses as executable code rather than raw text, leading to script injection [1] [2]. This affects all jQuery releases before 3.0.0.

Exploitation

An attacker must serve a malicious cross-domain endpoint that returns a text/javascript response. When a victim's browser makes a cross-origin Ajax request to that endpoint (typically via $.ajax() or shorthand methods like $.get() without dataType set), jQuery automatically evaluates the returned JavaScript in the context of the calling page [1]. No authentication or special privileges are required beyond the ability to induce the victim to visit a page making such a request.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking, data theft, defacement, or further cross-origin attacks. The attack achieves cross-domain script injection without explicit user interaction beyond visiting the attacker-controlled or attacker-influenced page [1].

Mitigation

Upgrade to jQuery 3.0.0 or later, where the browser's native XMLHttpRequest response handling is used and automatic script evaluation for cross-domain requests is removed [1] [2]. Users on unsupported branches (1.x and 2.x) should migrate to the latest 4.x release as these branches no longer receive security patches [2]. If upgrading is not immediately possible, ensure all cross-domain Ajax calls explicitly set dataType: 'text' or another non-executable type to prevent script evaluation.

References
  1. NVD - CVE-2015-9251
  2. GitHub - jquery/jquery: jQuery JavaScript Library

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
jquerynpm
< 1.12.21.12.2
jQueryNuGet
< 1.12.21.12.2
jQueryNuGet
>= 1.12.3, < 3.0.03.0.0
jquerynpm
>= 1.12.3, < 3.0.03.0.0
jquery-railsRubyGems
< 4.2.04.2.0
org.webjars.npm:jqueryMaven
< 1.12.21.12.2
org.webjars.npm:jqueryMaven
>= 1.12.3, < 3.0.03.0.0

Affected products

17

Patches

2
b078a6201378

Ajax: Mitigate possible XSS vulnerability

https://github.com/jquery/jqueryOleg GaidarenkoSep 10, 2015via ghsa
commit
3 files changed · +56 −1
  • src/ajax.js+1 −1 modified
    @@ -221,7 +221,7 @@ function ajaxConvert( s, response, jqXHR, isSuccess ) {
 
 		if ( current ) {
 
-		// There's only work to do if current dataType is non-auto
+			// There's only work to do if current dataType is non-auto
 			if ( current === "*" ) {
 
 				current = prev;
  • src/ajax/script.js+7 −0 modified
    @@ -4,6 +4,13 @@ define( [
 	"../ajax"
 ], function( jQuery, document ) {
 
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
+jQuery.ajaxPrefilter( function( s ) {
+    if ( s.crossDomain ) {
+        s.contents.script = false;
+    }
+} );
+
 // Install script dataType
 jQuery.ajaxSetup( {
 	accepts: {
  • test/unit/ajax.js+48 −0 modified
    @@ -71,6 +71,54 @@ QUnit.module( "ajax", {
 		};
 	} );
 
+	ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
+		return {
+			create: function( options ) {
+				options.crossDomain = true;
+				return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
+			},
+			success: function() {
+				assert.ok( true, "success" );
+			},
+			complete: function() {
+				assert.ok( true, "complete" );
+			}
+		};
+	} );
+
+	ajaxTest( "jQuery.ajax() - execute js for crossOrigin when dataType option is provided", 3,
+		function( assert ) {
+			return {
+				create: function( options ) {
+					options.crossDomain = true;
+					options.dataType = "script";
+					return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
+				},
+				success: function() {
+					assert.ok( true, "success" );
+				},
+				complete: function() {
+					assert.ok( true, "complete" );
+				}
+			};
+		}
+	);
+
+	ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
+		return {
+			create: function( options ) {
+				options.crossDomain = true;
+				return jQuery.ajax( url( "data/script.php" ), options );
+			},
+			success: function() {
+				assert.ok( true, "success" );
+			},
+			complete: function() {
+				assert.ok( true, "complete" );
+			}
+		};
+	} );
+
 	ajaxTest( "jQuery.ajax() - success callbacks (late binding)", 8, function( assert ) {
 		return {
 			setup: addGlobalEvents( "ajaxStart ajaxStop ajaxSend ajaxComplete ajaxSuccess", assert ),
f60729f3903d

Ajax: Mitigate possible XSS vulnerability

https://github.com/jquery/jqueryOleg GaidarenkoSep 10, 2015via ghsa
commit
2 files changed · +55 −0
  • src/ajax/script.js+7 −0 modified
    @@ -4,6 +4,13 @@ define( [
 	"../ajax"
 ], function( jQuery, document ) {
 
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
+jQuery.ajaxPrefilter( function( s ) {
+    if ( s.crossDomain ) {
+        s.contents.script = false;
+    }
+} );
+
 // Install script dataType
 jQuery.ajaxSetup( {
 	accepts: {
  • test/unit/ajax.js+48 −0 modified
    @@ -85,6 +85,54 @@ QUnit.module( "ajax", {
 		};
 	} );
 
+	ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
+		return {
+			create: function( options ) {
+				options.crossDomain = true;
+				return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
+			},
+			success: function() {
+				assert.ok( true, "success" );
+			},
+			complete: function() {
+				assert.ok( true, "complete" );
+			}
+		};
+	} );
+
+	ajaxTest( "jQuery.ajax() - execute js for crossOrigin when dataType option is provided", 3,
+		function( assert ) {
+			return {
+				create: function( options ) {
+					options.crossDomain = true;
+					options.dataType = "script";
+					return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
+				},
+				success: function() {
+					assert.ok( true, "success" );
+				},
+				complete: function() {
+					assert.ok( true, "complete" );
+				}
+			};
+		}
+	);
+
+	ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
+		return {
+			create: function( options ) {
+				options.crossDomain = true;
+				return jQuery.ajax( url( "data/script.php" ), options );
+			},
+			success: function() {
+				assert.ok( true, "success" );
+			},
+			complete: function() {
+				assert.ok( true, "complete" );
+			}
+		};
+	} );
+
 	ajaxTest( "jQuery.ajax() - success callbacks (late binding)", 8, function( assert ) {
 		return {
 			setup: addGlobalEvents( "ajaxStart ajaxStop ajaxSend ajaxComplete ajaxSuccess", assert ),

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

57

News mentions

0

No linked articles in our index yet.