---
title: "jQuery – XSS Vulnerability Under 3.0.0, When Making Cross-Domain Calls Without The dataType Option"
description: "Impact Area Security       Severity High       Affected Element **ServiceNow** UI Script **Salesforce** Static Resource Rule number **SN-JSL-013**** **(for ServiceNow) **SF-JSL-013 **(for Salesforce) ## Impact jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/jquery-xss-vulnerability-under-3-0-0-when-making-cross-domain-calls-without-the-datatype-option/"
updated: "2025-03-21"
category: Rules
---

# jQuery – XSS Vulnerability Under 3.0.0, When Making Cross-Domain Calls Without The dataType Option

Impact Area

Security

 

 

 

           Severity

High

 

 

 

           Affected Element

**ServiceNow**

UI Script

**Salesforce**

Static Resource

Rule number

**SN-JSL-013**** **(for ServiceNow)

**SF-JSL-013 **(for Salesforce)

## Impact

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

## Remediation

Update jQuery to the latest version.

### Time to fix

30 min