#1145372 nzbget: please update bundled jQuery (CVE-2020-11022, CVE-2020-11023)

Package:
nzbget
Source:
nzbget
Description:
command-line based binary newsgrabber for nzb files
Submitter:
Gajendra Nath Soren
Date:
2026-08-24 13:52:02 UTC
Severity:
normal
Tags:
#1145372#5
Date:
2026-08-24 13:50:37 UTC
From:
To:
The NZBGet web interface ships a bundled copy of jQuery at:
  webui/lib/jquery.js

This version is below 3.5.0 and is vulnerable to XSS via DOM
manipulation methods (CVE-2020-11022, CVE-2020-11023). Since NZBGet
actively serves this file to users via its web UI, the XSS
vulnerability is directly exploitable.

Please update the bundled jQuery to 3.5.0 or later, or use the
system libjs-jquery package instead.

Reference:
https://security-tracker.debian.org/tracker/CVE-2020-11022

Found by: Attack of the Clones GSoC 2026 pipeline
  (salsa.debian.org/rouca/gsoc2026)

Gajendra