CVE-2019-11358

6.1 mediumEPSS 87%

Medium (6.1). EPSS 87% chance of exploitation in the next 30 days. Fixed in jquery 3.4.0.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 87% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2019-04-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

backdropcms:backdrop
debian:debian_linux
drupal:drupal
fedoraproject:fedora
joomla:joomla\!
jquery:jquery
juniper:junos
netapp:oncommand_system_manager
netapp:snapcenter
opensuse:backports_sle
opensuse:leap
oracle:agile_product_lifecycle_management_for_process
oracle:application_express
oracle:application_service_level_management
oracle:application_testing_suite
oracle:banking_digital_experience
oracle:banking_enterprise_collections
oracle:banking_platform
oracle:bi_publisher
oracle:big_data_discovery
oracle:business_process_management_suite
oracle:communications_analytics
oracle:communications_application_session_controller
oracle:communications_billing_and_revenue_management
oracle:communications_diameter_signaling_router
oracle:communications_eagle_application_processor
oracle:communications_element_manager
oracle:communications_interactive_session_recorder
oracle:communications_operations_monitor
oracle:communications_services_gatekeeper
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:communications_unified_inventory_management
oracle:communications_webrtc_session_controller
oracle:diagnostic_assistant
oracle:enterprise_manager_ops_center
oracle:enterprise_session_border_controller
oracle:financial_services_analytical_applications_infrastructure
oracle:financial_services_analytical_applications_reconciliation_framework
oracle:financial_services_asset_liability_management
oracle:financial_services_balance_sheet_planning
oracle:financial_services_basel_regulatory_capital_basic
oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach
oracle:financial_services_data_foundation
oracle:financial_services_data_governance_for_us_regulatory_reporting
oracle:financial_services_data_integration_hub
oracle:financial_services_enterprise_financial_performance_analytics
oracle:financial_services_funds_transfer_pricing
oracle:financial_services_hedge_management_and_ifrs_valuations
oracle:financial_services_institutional_performance_analytics

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-6c3j-c64m-qhgq	npm	jquery	>=1.1.4 <3.4.0	3.4.0
GHSA-6c3j-c64m-qhgq	RubyGems	jquery-rails	<4.3.4	4.3.4
GHSA-6c3j-c64m-qhgq	NuGet	jQuery	>=1.1.4 <3.4.0	3.4.0
GHSA-6c3j-c64m-qhgq	PyPI	django	>=2.0a1 <2.1.9	2.1.9
GHSA-6c3j-c64m-qhgq	PyPI	django	>=2.2a1 <2.2.2	2.2.2
GHSA-6c3j-c64m-qhgq	Maven	org.webjars.npm:jquery	>=1.1.4 <3.4.0	3.4.0
GHSA-6c3j-c64m-qhgq	Packagist	maximebf/debugbar	<1.19.0	1.19.0
PYSEC-2026-628	PyPI	django	>=2.0a1 <2.1.9 >=2.2a1 <2.2.2	2.1.9, 2.2.2

References

Check your stack JSON