I am working on an enterprise project and we have a upcoming new release. The security team runs a security scan, in that vulnerability report there is one point that I am struggling with. The project uses jQuery 1.4.x and it causes a XSS vulnerability, namely this one. I need to upgrade jQuery but the latest version will cause a lot of problems. My question is there least version of jQuery that is striped from the XSS vulnerability?
To get away from the reported issues, (which will show up via projects like retire JS), you'll need to use a JQuery version in the 3.x line. At least one of the commonly referenced issues (this one) required breaking changes and as such was never fixed in the 1.X stream.
The current latest version is 3.2.1 and I'm not aware of it having any disclosed XSS issues.