elegant
elegant copied to clipboard
[BUG] Vulnerable outdated jQuery Version
Mandatory Step
- [ x ] I am using latest production release of Elegant
Description
Elegant currently uses Version 1.11.1 from the jQuery CDN https://github.com/Pelican-Elegant/elegant/blob/20cb4aef89ca83fc8b9d1ac3d131247f8d2937ff/templates/base.html#L107
This (and other older) Version of Bootstrap are vulnerable to Cross-Side Scripting.
If there are no breaking changes by upgrading I would recommend removing jQuery soon or to update the script to:
<script
src="http://code.jquery.com/jquery-3.5.1.min.js"
integrity="sha256-9/aliU8dGd2tb6OSsuzixeV4y/faTqgFtohetphbbj0="
crossorigin="anonymous"></script>
If you want I can file a pull request.
Anecdotal evidence: Doesn't brake anything for me.
This issue would go away when we get rid of JQuery altogether as per https://github.com/Pelican-Elegant/elegant/issues/220