Outdated jQuery and friends: the libraries squirrel detects

Why the library version matters

A client-side library runs with the same privileges as your own code. A known cross-site scripting hole in an old version of jQuery or Bootstrap is exploitable from the page it is loaded on, and the fix is almost always a version bump rather than a rewrite.

Version is also the number that tells you whether a dependency is being maintained at all. A library detected at a release from several years ago usually means nothing has updated it since it was added, which is worth knowing separately from any specific advisory.

What squirrel checks

The rule runs on every crawled page and tries to detect twenty-two libraries: jQuery, React, Vue.js, Angular, Svelte, Next.js, Nuxt, Bootstrap, Tailwind CSS, Lodash, Underscore.js, Moment.js, Day.js, Axios, Redux, D3.js, Chart.js, Three.js, GSAP, Prototype.js, MooTools and YUI. It emits one or two checks:

• js-libraries-vulnerable: fails with the message N library/libraries with known vulnerabilities, listing each as <name> v<version> with the advisory description as the label and the CVE in the metadata. The version suffix is omitted when none was extracted.
• js-libraries-detected: reports the message N JavaScript library/libraries detected, at warn status when something vulnerable was found and at info status otherwise. Each item is <name> v<version>, without the version when none was found, labelled either vulnerable or with how it was detected.
• js-libraries: reports at info status with the message No common JavaScript libraries detected.

Detection is tried in three passes and stops once a library is both detected and versioned. First the script URLs, which are the page’s <script src> values plus the URLs of any scripts the crawl fetched, reported as script URL. Then the inline and bundled script content, which is every inline script over 50 characters plus the bodies of the fetched scripts, reported as inline code. Then the page HTML itself, reported as HTML markers, which is how a framework attribute such as Angular’s version marker is found. Without a version no vulnerability check runs.

Only five of the twenty-two carry advisory data: jQuery, Bootstrap, Lodash, Prototype.js and YUI. A version is flagged when it is at or below the advisory’s maximum affected version. A page with no parsed document, or no HTML, emits nothing at all.

Elements inside <noscript> are skipped: a browser with scripting enabled reads <noscript> content as plain text, so nothing in it loads or renders. See content inside noscript.

How to fix it

Update the dependency. For a library loaded from a CDN that is one URL:

<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>

For one that comes through a bundler, npm audit names the advisory and the version that fixes it, and a lockfile update ships it.

The limit worth knowing is a version this rule could not read. Detection often finds the library without a version, in which case nothing is checked against the advisories and the library is reported as present only. Absence from the vulnerable list is not evidence that the version is safe.

Enable / disable

Disable this rule

[rules]
disable = ["perf/js-libraries"]

Disable all Performance rules

[rules]
disable = ["perf/*"]

Enable only this rule

[rules]
enable = ["perf/js-libraries"]

enable replaces the default ["*"], so this is the only rule selected. Leave disable out: a rule that matches any disable pattern is skipped even when enable names it. Only an enabled setting under a rule’s own [rule_options] table overrides both lists.

Related rules

• perf/duplicate-js: the same library loaded twice, sometimes at two versions.
• perf/legacy-js: polyfills that often arrive with an old library.
• security/sri: subresource integrity on the CDN URLs those libraries come from.
• perf/js-file-size: the weight those libraries add.

Performance findings ship in every audit next to the SEO, security and agent experience rules. See Core Web Vitals for how an agent works through a report.

References

• Vulnerable and outdated components, OWASP Top 10
• The script element, HTML Standard

Check your site

Run squirrel audit https://example.com and open the Performance section of the report. Each detected library is listed with its version and how it was found. Signed-out local audits need no account and cost nothing. Signed-in audits spend credits.