Scanaris
Scan for free
← All checks
SecurityTypical severity: High

Outdated Library Scanner

Detects vulnerable or end-of-life versions of jQuery, AngularJS and Bootstrap with known XSS CVEs.

What it checks

This scanner identifies the versions of common front-end libraries like jQuery, AngularJS and Bootstrap that your site loads. It flags those that are vulnerable or end-of-life versions with known, documented XSS flaws.

Why it matters

Running a library with public vulnerabilities is a well-known open door: attackers look for exactly those versions because the flaw is already published. An XSS through an outdated library can allow session theft or content injection on your site.

How to fix it

Update those libraries to a supported version with no known vulnerabilities, checking first that nothing breaks. If a library is no longer maintained, like AngularJS, consider migrating to a modern alternative that still gets updates.

How this check works

Scanaris gathers the HTML of your main page and downloads up to fifteen of its scripts: all those served from your own domain and, among external ones, those with "jquery" in the path. In that text it searches for the version banners libraries include at the top of the file. Three cases open a finding, all medium severity. jQuery earlier than 3.5.0: known XSS vulnerabilities (CVE-2020-11022 and CVE-2020-11023) in how it processes HTML. AngularJS, any 1.x version: the framework reached end of life in January 2022 and receives no security patches. Bootstrap 3.x earlier than 3.4.1 or 4.x earlier than 4.3.1: XSS through data- attributes in tooltips and popovers (CVE-2019-8331). It only flags when it finds the version number written out; if the file is minified without a banner, it does not guess.

Why it matters

An XSS vulnerability in a library loaded by your whole site is an open door on every page at once: an attacker who manages to get text where the library interprets it as HTML (a comment, a profile name, a URL parameter) runs JavaScript with the session of whoever views it. For these three libraries the flaws have been public for years, with published exploitation examples, and automated tools test for them out of the box. The AngularJS case is different but worse in the long run: it is not one specific flaw, it is that the next one to appear will never be fixed.

Why it happens

Because they work. A jQuery 1.12 from 2016 still does what it did and nobody touches it for fear of breaking something. WordPress themes and plugins are the typical case: WordPress core has shipped jQuery 3.7 since version 5.6, but an old theme may load its own copy. It also shows up in purchased HTML templates, inherited admin panels and projects where the AI copied an example with a years-old CDN URL.

How to fix it

  • jQuery: update to the latest 3.x (3.7 is the current branch). Change the CDN URL or the local file, and load jquery-migrate for a few days so it warns you in the console about old calls that need adapting. Test forms, menus and any jQuery plugin you use.
  • Bootstrap: if you are on 3.x, move to 3.4.1, which is compatible; if on 4.x, to 4.6.2. They are maintenance releases with no design changes. Jumping to 5.x is a bigger migration because it drops jQuery and renames classes; plan it separately.
  • AngularJS: there is no safe version to move up to. The options are migrating (to modern Angular, Vue or React, in parts if the app is large), buying commercial extended support in the meantime, or isolating the app: no sensitive data, behind authentication and with a strict CSP.
  • WordPress: update the theme and plugins; if one of them keeps loading an old jQuery, replace it. Do not disable core jQuery to "save weight": it is the good version.
  • In general: install libraries with npm instead of copying CDN URLs, and turn on GitHub dependency alerts or npm audit to hear about the next one.

Check it is fixed

curl -s https://yourdomain.com | grep -oE 'src="[^"]*(jquery|bootstrap|angular)[^"]*"'
curl -s SCRIPT_URL | head -c 400 | grep -oE '(jQuery|Bootstrap|AngularJS)[^0-9]{0,30}v?[0-9]+\.[0-9]+\.[0-9]+'

The first tells you which files your site loads; the second, with each one's URL, the version they declare. Expected: jQuery 3.5.0 or later, Bootstrap 3.4.1, 4.3.1 or later, and no AngularJS.

Frequently asked questions

Are only these three libraries detected?

For now, yes: they account for most of the exploited front-end vulnerabilities on real sites. For the rest of your dependencies, npm audit or GitHub alerts cover what an external scan cannot see.

I use jQuery 1.12 but never insert user HTML. Am I safe?

As long as nobody passes untrusted text through .html(), .append() or similar, the specific flaw does not trigger. But that is hard to guarantee across the whole site and every plugin, and the update to 3.x usually takes an afternoon. In the meantime, a strict CSP limits the damage; weak CSP reviews it.

What if the library comes from a CDN?

Then, besides updating it, pin the version and add integrity so nobody can swap it underneath you; subresource integrity explains how.

Check it on your site

Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.

Scan my site free

Related checks

Security Headers ScannerInsecure Cookie ScannerPermissive CORS ScannerSensitive File Exposure ScannerJavaScript Secret ScannerTLS Certificate Scanner