The ZNC web interface ships a bundled copy of jQuery 1.11.2 at:
  webskins/_default_/pub/jquery-1.11.2.js

This version is vulnerable to XSS via DOM manipulation methods
(CVE-2020-11022, CVE-2020-11023, fixed in jQuery 3.5.0). Since ZNC
actively serves this file to users via its web interface, the XSS
vulnerability is exploitable via the ZNC web UI.

Please update the bundled jQuery to 3.5.0 or later, or remove the
bundled copy and use the system libjs-jquery package instead.

Reference:
https://security-tracker.debian.org/tracker/CVE-2020-11022
https://github.com/advisories/GHSA-gxr4-xjj5-5px2

Found by: Attack of the Clones GSoC 2026 pipeline
  (salsa.debian.org/rouca/gsoc2026)

Gajendra Nath Soren

forwarded #1145369 https://github.com/znc/znc/issues/2040
thanks

Am 24.08.2026 um 15:48 schrieb Gajendra Nath Soren:

We believe that the bug you reported is fixed in the latest version of
znc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145369@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Patrick Matthäi <pmatthaei@debian.org> (supplier of updated znc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 16 Sep 2026 15:04:37 +0200
Source: znc
Architecture: source
Version: 1.10.3-1
Distribution: unstable
Urgency: high
Maintainer: Patrick Matthäi <pmatthaei@debian.org>
Changed-By: Patrick Matthäi <pmatthaei@debian.org>
Closes: 1145369
Changes:
 znc (1.10.3-1) unstable; urgency=high
 .
   * New upstream release.
     - Fixes CVE-2026-82373 and CVE-2026-82374.
     - Updated jQuery. Fixes CVE-2020-11022 and CVE-2020-11023.
       Closes: #1145369
   * Update debian/copyright years.
   * Adjust lintian overrides.
Checksums-Sha1:
 2c54158b18f6bc17924b85cd2e80f7f35b2b1c61 2444 znc_1.10.3-1.dsc
 bddb815d3159e42f6f556e9888dda424129ad355 2313669 znc_1.10.3.orig.tar.gz
 f6da28058f3b0f7051d39a60a77f9d907aa06bb2 870 znc_1.10.3.orig.tar.gz.asc
 b7ddd91aecebc86c4cd75e802d7eb4c19e22f406 512372 znc_1.10.3-1.debian.tar.xz
 52dd2c0d1c4e60c1b216884786ab14b3a12a8f72 8095 znc_1.10.3-1_source.buildinfo
Checksums-Sha256:
 ccd0b2c397ac26556adee95946783f97f3488e31b91b3d2687abbe30eb60a290 2444 znc_1.10.3-1.dsc
 68f3f6641b480c041010c5596e1234043e05c9137eda06233845017603095f5b 2313669 znc_1.10.3.orig.tar.gz
 f52694233898782a305f19bb15c928ad57adc7148a2122fd38660bf63981d0e3 870 znc_1.10.3.orig.tar.gz.asc
 e945eb96f710b6e209c5a3c2f6e8dad6bd32510edba26ca164aa305ffc154d8e 512372 znc_1.10.3-1.debian.tar.xz
 84134904563380d39ad4c5466882030b6d1b07057421ca7205d11c522cbca259 8095 znc_1.10.3-1_source.buildinfo
Files:
 9679e23891359149bcbcec0d06639493 2444 net optional znc_1.10.3-1.dsc
 3a6040a4f394d05fe133b442d274df55 2313669 net optional znc_1.10.3.orig.tar.gz
 a015726b6690fda16aa65828c83ee1c8 870 net optional znc_1.10.3.orig.tar.gz.asc
 57284e4305f90a870066c3c90f0f7981 512372 net optional znc_1.10.3-1.debian.tar.xz
 d06582358b63ad8056d01b6cf1a9902f 8095 net optional znc_1.10.3-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEWKA9xYJCWk3IuQ4TEtmwSpDL2OQFAmqql+IACgkQEtmwSpDL
2OR1Iw//Vfx43ETseNEEMo5DwjE76pzSIGehSVPa9k8ARL/l16x9yzqJf1PehVBr
ZcuT9lxMkZnPdbn4kuWy9OXYAM4B1ZaZNyEkNLKStz2lly80RIOj0DHqQ9uULHGQ
CPRqhGTtCPhSVSq6Zbv6HtR0iWb3uLxYWZiypMZUnojsPTaX4MXx3dcB7JSLz65b
BprWmNAu5nxSbk3GeME1hNE584gtz1tERF15YUVywWGlGcTk2hB9tczoPpx3KUFC
oXc5Cm99JXcRtP8ByL7qt9+8aIEQO0ekSkcjuGeoEIYAOZEKsoixxnnGBt/MJ+0S
ubXm4L5kR+n2rugWRCIypjBemM49ksh3/XyapXT2k0sIqvnbaIUfizPKiiHYuE0Z
FVipB0zeZ4G5FjTvbSa86BPCD2vPyOuUVHnd0uXt+1aF0hVBfSJFJfX0ESQhTDaI
D3EGJ9rDYrkiLhDlXNDhBvc0+hZIgvLksia6Y6UgbmTjwbpZ2w20J1+T6k6gjApz
lTXetNZx67DO0A/RyZjHPR9DQmS59ZlnYMMBtWuSqXxT0wddVJd8oW63KfbMf6aw
cIN7CcjAAmK6x65n0ANz/sDH0uOMJWSUr7kUByZRtIUHjzAFudMxw8L4PPPg8NBQ
RgZ/2oZ6KO15Em8HG2GgDGlIwlY8pspYEDQSj4R0xKnnS1V0ODA=
=PQGW
-----END PGP SIGNATURE-----