CVE-2025-3573
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
jQuery Validation is a JavaScript library that simplifies form validation by providing customizable rules and messages to ensure user input meets specified criteria on web pages.
A medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2025-3573) has been identified in jQuery Validation. The vulnerability resides in the showLabel() function, which fails to properly sanitize user-controlled input used in a placeholder value. This allows attackers to inject malicious scripts that can execute in the context of a user's browser.
A Cross-site Scripting (XSS) vulnerability is a type of security flaw that allows attackers to inject malicious scripts into webpages. It often occurs when a site fails to properly validate or sanitize user input, enabling the execution of unauthorized code within a victim's browser. It is included in the OWASP Top Ten list of vulnerabilities, specifically in the third category of Injection. A web site compromised in this way may experience:
- Session hijacking
- Data theft
- Malware distribution
- Defacement or phishing and
- Privilege escalation.
This issue affects jQuery Validation versions lower than 1.20.0.
Details
Module Info
- Product: jQuery
- Affected code: jquery-validation
- Affected versions: <1.20.0
- Project page: https://github.com/jquery-validation/jquery-validation
- Fixed in: NES for jQuery Validation 1.19.4
Vulnerability Info
A cross-site scripting (XSS) issue exists in showLabel() where user-controlled placeholder text can flow into $.validator.messages (a localizable message dictionary) and be rendered without sanitization, allowing injected script to execute in the user’s browser. This medium-severity vulnerability is found in jQuery Validation in versions lower than 1.20.0.
Mitigation
Users of the affected component should apply one of the following mitigations:
- If user input is used for a placeholder value, be sure to sanitize it.
- Migrate affected applications away from jquery-validation.
- Sign up for security support; HeroDevs customers get immediate access to a patched version of this module.
Sign up for security support; HeroDevs customers get immediate access to a patched version of this module.
Credits
- Volkan Ceylan (volkanceylan)
Additional Resources
Drupal Security Advisory:
https://www.d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001/
