PYSEC-2026-628

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

At a glance

Published: 2026-07-02 14:13 UTC
Updated: 2026-07-06 08:11 UTC
CVE: CVE-2019-11358
Aliases: DRUPAL-CORE-2019-006, GHSA-6c3j-c64m-qhgq
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.

Affected packages

Package	Versions
PyPI · django	introduced 2.0a1, fixed 2.1.9, introduced 2.2a1, fixed 2.2.2

References

https://nvd.nist.gov/vuln/detail/CVE-2019-11358 ADVISORY
https://github.com/maximebf/php-debugbar/issues/447 WEB
https://github.com/jquery/jquery/pull/4333 WEB
https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc WEB
https://github.com/django/django/commit/34ec52269ade54af31a021b12969913129571a3f WEB
https://github.com/django/django/commit/95649bc08547a878cebfa1d019edec8cb1b80829 WEB
https://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee6e6ad WEB
https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5 WEB
https://seclists.org/bugtraq/2019/Apr/32 WEB
https://seclists.org/bugtraq/2019/Jun/12 WEB
https://seclists.org/bugtraq/2019/May/18 WEB
https://www.tenable.com/security/tns-2020-02 WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA WEB
https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html WEB
https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html WEB
https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html WEB
https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html WEB
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E WEB
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E WEB
https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d@%3Cissues.flink.apache.org%3E WEB
https://www.tenable.com/security/tns-2019-08 WEB
https://www.synology.com/security/advisory/Synology_SA_19_19 WEB
https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery WEB
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html WEB
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html WEB
https://www.oracle.com/security-alerts/cpuoct2021.html WEB
https://www.oracle.com/security-alerts/cpuoct2020.html WEB
https://www.oracle.com/security-alerts/cpujul2020.html WEB
https://www.oracle.com/security-alerts/cpujan2022.html WEB
https://www.oracle.com/security-alerts/cpujan2021.html WEB
https://www.oracle.com/security-alerts/cpujan2020.html WEB
https://www.oracle.com/security-alerts/cpuapr2020.html WEB
https://www.oracle.com/security-alerts/cpuApr2021.html WEB
https://www.oracle.com//security-alerts/cpujul2021.html WEB
https://www.drupal.org/sa-core-2019-006 WEB
https://www.djangoproject.com/weblog/2019/jun/03/security-releases WEB
https://www.debian.org/security/2019/dsa-4460 WEB
https://www.debian.org/security/2019/dsa-4434 WEB
https://web.archive.org/web/20190824065237/http://www.securityfocus.com/bid/108023 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database