From f3a9ee8ed67ba43fcbbe3c953c516e4665787ece Mon Sep 17 00:00:00 2001 From: Umer-Azaz Date: Sat, 9 May 2026 15:30:18 +0500 Subject: [PATCH] chore(gui): upgrade jQuery to 3.7.1 to fix CVE-2020-11022, CVE-2020-11023, CVE-2015-9251 (#10673) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Replace vendored `jquery-2.2.2.js` with `jquery-3.7.1.js` in `gui/default/vendor/jquery/` - Update script reference in `gui/default/index.html` to point to the new file - Update CDN reference in `cmd/infra/strelaypoolsrv/gui/index.html` from `jquery-2.1.4.min.js` to `jquery-3.7.1.min.js` ## Why The previously used jQuery versions (2.2.2 and 2.1.4) are vulnerable to three known CVEs: | CVE | Description | Fixed in | |-----|-------------|----------| | CVE-2015-9251 | XSS via cross-domain Ajax requests with non-text content types | jQuery 3.0.0 | | CVE-2020-11022 | XSS when passing HTML containing `