Jquery Vulnerabilities

ZK framework includes a customized jQuery library. Replacing that bundled jQuery in ZK to solve its security vulnerability isn't an option. This is because ZK and jQuery are deeply integrated with zk-specific customizations. Also, JQuery introduces breaking changes between major versions. Simply replacing jQuery won’t work.

To address this, please upgrade ZK to a patched version or a non-affected version.

ZK version	Bundled jQuery Status	Fixed Vulnerabilities
9.1.0 or above	3.5.1	CVE-2020-11022 CVE-2020-11023
9.0.0	1.12.4
8.6.4.1 8.6.3.1 8.6.0.2 8.5.1.3 8.5.0.1	1.10.2 with security patches	CVE-2015-9251 (ZK-3724) CVE-2019-11358(ZK-4599)

You can check zk-bundled jQuery version by this js variable jq.fn.jquery.