defunkt/jquery-pjax — Issue #71: XSS via DOM
Author: cloudsorrow
Created: 2011-11-26 06:52:09+00:00
State: open

The method success() in jquery.pjax.js sends unvalidated data to a web browser on line 160, which can result in the browser executing malicious code.

In jquery-pjax.js, line 160, the success method doesn't properly validate the malicious input returned from making the hash. Mind you, it is only as strong as the client protections enabled on the browser.