jquery/jquery — pull request #1505 by fhemberger (2014-01-31 13:50:05+00:00)
Title: jQuery.parseHTML: Mitigate XSS vulnerability

Scripts passed in event attributes are executed in `parseHTML` immediately,
without any possibility for the user to intervene:

`jQuery.parseHTML('');`

To mitigate this vulnerability `document.implementation.createHTMLDocument()`
should be used as standard context instead of `document`. Now the user has
to set a different context deliberately for this issue to occur.

See also jQuery ticket #13921.