CVE-2025-3573: jquery-validation vulnerable to Cross-site Scripting
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
References
- github.com/advisories/GHSA-rrj2-ph5q-jxw2
- github.com/jquery-validation/jquery-validation
- github.com/jquery-validation/jquery-validation/commit/7a490d8f39bd988027568ddcf51755e1f4688902
- github.com/jquery-validation/jquery-validation/pull/2462
- nvd.nist.gov/vuln/detail/CVE-2025-3573
- security.snyk.io/vuln/SNYK-JS-JQUERYVALIDATION-5952285
Code Behaviors & Features
Detect and mitigate CVE-2025-3573 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →