\", which results in the enclosed script logic to be executed.","datePublished":"2020-05-19T21:15:10.257Z","dateModified":"2026-06-17T03:25:12.767Z","publisher":{"@type":"Organization","@id":"https://portal.vyprsec.ai#publisher","name":"VYPR","url":"https://portal.vyprsec.ai","logo":{"@type":"ImageObject","url":"https://portal.vyprsec.ai/icon.svg","width":64,"height":64},"description":"Real-time CVE intelligence newsroom — feeds, exploits, vendor advisories, and AI-synthesized insights."},"author":{"@type":"Organization","@id":"https://portal.vyprsec.ai#publisher","name":"VYPR","url":"https://portal.vyprsec.ai","logo":{"@type":"ImageObject","url":"https://portal.vyprsec.ai/icon.svg","width":64,"height":64},"description":"Real-time CVE intelligence newsroom — feeds, exploits, vendor advisories, and AI-synthesized insights."},"proficiencyLevel":"Expert","about":{"@type":"Thing","@id":"https://nvd.nist.gov/vuln/detail/CVE-2020-7656","name":"CVE-2020-7656","identifier":"CVE-2020-7656","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\", which results in the enclosed script logic to be executed.","additionalType":"https://schema.org/SoftwareApplication","sameAs":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7656"]},"keywords":"CVE-2020-7656, Medium, CWE-79, jQuery jQuery, NetApp Active Iq Unified Manager, NetApp Active Iq Unified Manager, NetApp Active Iq Unified Manager, NetApp Cloud Backup, NetApp Oncommand System Manager, NetApp Snap Creator Framework, Oracle Corporation Peoplesoft Enterprise Peopletools, Juniper Networks Junos, jQuery jQuery","mentions":[{"@type":"SoftwareApplication","name":"jQuery","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"jQuery"}},{"@type":"SoftwareApplication","name":"Active Iq Unified Manager","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"NetApp"}},{"@type":"SoftwareApplication","name":"Active Iq Unified Manager","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"NetApp"}},{"@type":"SoftwareApplication","name":"Active Iq Unified Manager","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"NetApp"}},{"@type":"SoftwareApplication","name":"Cloud Backup","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"NetApp"}},{"@type":"SoftwareApplication","name":"Oncommand System Manager","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"NetApp"}},{"@type":"SoftwareApplication","name":"Snap Creator Framework","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"NetApp"}},{"@type":"SoftwareApplication","name":"Peoplesoft Enterprise Peopletools","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Oracle Corporation"}},{"@type":"SoftwareApplication","name":"Junos","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Juniper Networks"}},{"@type":"SoftwareApplication","name":"jQuery","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"jQuery"}}],"isAccessibleForFree":true},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://portal.vyprsec.ai/"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://portal.vyprsec.ai/cves"},{"@type":"ListItem","position":3,"name":"CVE-2020-7656","item":"https://portal.vyprsec.ai/cves/CVE-2020-7656"}]}]}

Medium severity6.1NVD Advisory· Published May 19, 2020· Updated Jun 17, 2026

CVE-2020-7656

Description

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "", which results in the enclosed script logic to be executed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
jquerynpm	>= 1.2.1, < 1.9.0	1.9.0
jQueryNuGet	>= 1.2.1, < 1.9.0	1.9.0
jquery-railsRubyGems	< 2.2.0	2.2.0
org.webjars.npm:jqueryMaven	>= 1.2.1, < 1.9.0	1.9.0

Affected products

jQuery/jQuery2 versions
cpe:2.3:a:jquery:jquery:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:jquery:jquery:*:*:*:*:*:node.js:*:*range: <1.9.0
- (no CPE)range: All versions prior to version 1.9.0
NetApp/Active Iq Unified Manager3 versions
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*+ 2 more
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
NetApp/Cloud Backup
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
NetApp/Oncommand System Manager
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
Range: >=3.0.0,<=3.1.3
NetApp/Snap Creator Framework
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
Oracle Corporation/Peoplesoft Enterprise Peopletools
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Juniper Networks/Junos
cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*
ghsa-coords6 versions
pkg:gem/jquery-rails pkg:maven/org.webjars.npm/jquery pkg:npm/jquery pkg:nuget/jquery pkg:rpm/almalinux/pcs pkg:rpm/almalinux/pcs-snmp
< 2.2.0+ 5 more
- (no CPE)range: < 2.2.0
- (no CPE)range: >= 1.2.1, < 1.9.0
- (no CPE)range: >= 1.2.1, < 1.9.0
- (no CPE)range: >= 1.2.1, < 1.9.0
- (no CPE)range: < 0.10.10-4.el8.alma
- (no CPE)range: < 0.10.10-4.el8.alma

Patches

Vulnerability mechanics

References

snyk.io/vuln/SNYK-JS-JQUERY-569619nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-q4m3-2j7h-f7xwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-7656ghsaADVISORY
security.netapp.com/advisory/ntap-20200528-0001/nvdThird Party Advisory
supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1nvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdThird Party AdvisoryWEB
github.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.jsghsaWEB
github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457dghsaWEB
github.com/jquery/jquery/commit/606b863edaff29035960e4d813b45d63b8d92876ghsaWEB
github.com/rails/jquery-rails/blob/master/CHANGELOG.mdghsaWEB
github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.jsghsaWEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2020-7656.ymlghsaWEB
security.netapp.com/advisory/ntap-20200528-0001ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.005
exploit	0.030
kev	0.000
patch	-0.070
ransomware	0.000