JQuery Security vulnerabilities

[anyilin]

Hello developer,
In the latest release (3.13.4), you still use a low-level JQuery (1.x) that has been found to have high-risk security vulnerabilities.
Do you have a plan to upgrade it? (such as upgrading to version 3.4.1)

 

[Rodolfo]

It is a real security concern or just these usual harmless stuff that it just get labeled as "critical"? I ask because jquery is used in the user interface, all the real validations are made in the backend.

 

[anyilin]

It looks like it is a real security vulnerabilitly

JQuery security vulnerabilities
PCI compliance scan picked up jQuery vulnerabilities:
vulnerable jQuery version: 1.10.2
Details: Two vulnerabilities fixed in jQuery 3.0.0
CVE 2015-9251
CVE 2016-10707

JQuery-ui security vulnerabilitly

Snyk Vulnerability Database | Snyk

Medium severity (6.1) Cross-site Scripting (XSS) in jquery-ui | CVE-2016-7103

snyk.io

And, the content of the first picture of the text is provided by Google Lighthouse.

 

[anyilin]

It is a real security concern or just these usual harmless stuff that it just get labeled as "critical"? I ask because jquery is used in the user interface, all the real validations are made in the backend.

Well, do you have a plan to upgrade it?

 

[Rodolfo]

Since it doesn't affect Chevereto it is not something to worry about.

In any case, jquery will get updated in a future revision.