I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of eval, settimeout, inner/outerhtml and so on. However, the modules which have these issues are not used/called in the application.

Considering the above scenario, Is there any way by which an attacker can exploit my app based on the XSS vectors in the 3rd party libs, even if the vulnerable modules are not used in my app?

  • 1
    You have answered the question. It depends on the module you are using.If there is a vulnerability in the module, it can be exploited like bugs.jqueryui.com/ticket/6016..This was a previous vulnerability in jquery. So it is better to check the existing vulnerabilities in 3rd party libraries before using them – aRun Mar 12 '13 at 7:50

Possible, but unlikely. Why?

Allow me give you some background information. I've seen people obsess over supposed "XSS vulnerabilities" in jQuery and many other libraries, here's one example:

$('#inputElement').keyup(function () {

Some would argue that this code is vulnerable to XSS, which is not true. Yes, you can write JavaScript in the input field and have it executed (for example, <script>alert(document.cookie)</script) but so what? You can already do that with with any application that gives you JavaScript console (Firebug), heck, you can even do it with Greasemonkey.

It can be only considered an XSS vulnerability if data from outside your app is used inside your app by tricking the user into malicious URL or submitting a specially crafted form. Here's an example:

$(document).ready(function () {

Now this is vulnerable to XSS, an attacker could craft the following URL


Or even use some URL shortening services to make the attack a bit more obfuscated. The point is, in such cases you need to worry.

If the client side of your webapp is using data from outside and it's possible that the legitimate user might not have control over it (like the case above), then you need to worry.

Another example using History API-fallback libraries, such as jQuery BBQ (it parses window.location.hash) which might be vulnerable and somehow allows code in the URL to be executed.

Please note that this answer is strictly in the scope of your question; XSS attacks related to JavaScript libraries.


Yes, definetely. Here is a recent example from Yahoo, where an old JS library caused an XSS http://abysssec.com/files/Yahoo!_DOMSDAY.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.