Possible, but unlikely. Why?
Allow me give you some background information. I've seen people obsess over supposed "XSS vulnerabilities" in jQuery and many other libraries, here's one example:
$('#inputElement').keyup(function () {
$('#someDiv').html($(this).val())
});
Some would argue that this code is vulnerable to XSS, which is not true. Yes, you can write JavaScript in the input field and have it executed (for example, <script>alert(document.cookie)</script) but so what? You can already do that with with any application that gives you JavaScript console (Firebug), heck, you can even do it with Greasemonkey.
It can be only considered an XSS vulnerability if data from outside your app is used inside your app by tricking the user into malicious URL or submitting a specially crafted form. Here's an example:
$(document).ready(function () {
$('#someDiv').html(window.location.hash)
});
Now this is vulnerable to XSS, an attacker could craft the following URL
http://example.com/search/searchQuery+<script>alert(document.cookie)</script>
Or even use some URL shortening services to make the attack a bit more obfuscated. The point is, in such cases you need to worry.
If the client side of your webapp is using data from outside and it's possible that the legitimate user might not have control over it (like the case above), then you need to worry.
Another example using History API-fallback libraries, such as jQuery BBQ (it parses window.location.hash) which might be vulnerable and somehow allows code in the URL to be executed.
Please note that this answer is strictly in the scope of your question; XSS attacks related to JavaScript libraries.
