- Backdrop Core 1.16.x versions prior to 1.16.1
- Backdrop Core 1.15.x versions prior to 1.15.3
Backdrop versions 1.14 and prior do not receive security coverage.
The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are
[...] security issues in jQuery’s DOM manipulation methods, as in
.append(), and the others. Security advisories for both of these issues have been published on GitHub.
Those advisories are:
These vulnerabilities may be exploitable on some Backdrop sites. This security release backports the fixes to the relevant jQuery functions without making any other changes to the jQuery version that is included in core, or running on the site via some other module such as jQuery Update. It is not necessary to update jquery_update on sites that have the module installed.
If you find a regression caused by the jQuery changes, please report it in Backdrop core's issue queue (or that of the relevant contrib project). However, if you believe you have found a security issue, please report it privately to the Backdrop Security Team.
- Drew Webber of the Drupal Security Team
- Sally Young
- cilefen of the Drupal Security Team
- Jess of the Drupal Security Team
- Emerson Jair Reis Oliveira da Silva
- Lee Rowlands of the Drupal Security Team
- Alex Bronstein of the Drupal Security Team
- Ben Mullins
- Lauri Eskola
- Peter Weber
- Samuel Mortenson of the Drupal Security Team
- Jen Lampton of the Backdrop CMS Security Team
- Nate Lampton of the Backdrop CMS Security Team