The ZNC web interface ships a bundled copy of jQuery 1.11.2 at:
  webskins/_default_/pub/jquery-1.11.2.js

This version is vulnerable to XSS via DOM manipulation methods
(CVE-2020-11022, CVE-2020-11023, fixed in jQuery 3.5.0). Since ZNC
actively serves this file to users via its web interface, the XSS
vulnerability is exploitable via the ZNC web UI.

Please update the bundled jQuery to 3.5.0 or later, or remove the
bundled copy and use the system libjs-jquery package instead.

Reference:
https://security-tracker.debian.org/tracker/CVE-2020-11022
https://github.com/advisories/GHSA-gxr4-xjj5-5px2

Found by: Attack of the Clones GSoC 2026 pipeline
  (salsa.debian.org/rouca/gsoc2026)

Gajendra Nath Soren