JavaScript libraries with known vulnerabilities

What we check

Many websites use ready-made JavaScript libraries: jQuery for animations and forms, Bootstrap for the layout, Lodash, Moment.js, slider or lightbox scripts. We load the home page in a real browser and detect which libraries run in which version.

We compare these with the public database of the Retire.js project, which collects known vulnerabilities per version. In the report you see every affected library with the number of known vulnerabilities and the version that closes them all.

For this we request no additional files on the server. The version is a pointer: not every library reveals its version, and libraries that run only on subpages are not seen by us.

Why it matters

Most vulnerabilities in these libraries allow cross-site scripting: an attacker gets the page to run foreign code. This code runs in the browser of the visitors, with all the rights of the website. It can grab form input, display forged content or redirect visitors to fraud pages.

Whether a vulnerability can really be exploited depends on how the website uses the library. Only a close check of the code can give a reliable statement. Two things are clear, though:

• Attackers search automatically for websites with known, vulnerable versions.
• Libraries that are many years old show that the website has not been technically maintained for some time. Usually other parts are then outdated too.

How to fix it

Website with a CMS

With WordPress, Joomla or TYPO3 the libraries almost always come with the CMS itself, the theme or a plugin. First update all of these components. If the old version remains afterwards, find out with the agency in charge which component brings it along and replace it.

Individually developed website

Ask the agency in charge to update the libraries named to the version given in the report or newer. Small updates within a major version, for example from jQuery 3.4 to 3.7, are usually unproblematic. With a change of major version, for example from jQuery 1 to 3, the website has to be tested thoroughly afterwards.

Libraries from foreign servers

If the page loads libraries from a CDN such as cdnjs or jsDelivr, the version is in the address. Change the version number there and test the website.

Additional protection

A Content Security Policy limits the damage if code is injected after all. More on this in the article on the protective settings of the server.

How to check it yourself

Open the developer tools (F12), switch to the console and type jQuery.fn.jquery. If jQuery is loaded, the version number appears. The browser extension "Wappalyzer" shows all detected libraries with their version.

Frequently asked questions

Has the website been hacked if a vulnerability is reported here?

No. A known vulnerability means that an attack could be possible, not that one has taken place. Whether it can be exploited depends on how the website uses the library.

Why does a website load an old jQuery version at all?

Often an older theme, a plugin or an embedded service brings it along. Some themes deliberately load an old version so that older scripts keep working.