Rule Definition
While some known vulnerabilities lead to only minor impacts, some of the largest breaches to date have relied on exploiting known vulnerabilities in components. Depending on the assets you are protecting, perhaps this risk should be at the top of the list.

Remediation
Always provide dataType parameter.

Violation Code Sample

$.ajax({ 
    type : "POST", 
    url : /v1/user, 
    success : function() { 

    }, 
    error : function(error) { 

    }});

Fixed Code Sample

<script src="https://code.jquery.com/jquery-2.1.4.js"></script> 
    <script src="https://code.jquery.com/ui/1.12.0/jquery-ui.js"></script> 
    <link rel="stylesheet" type="text/css" href="http://code.jquery.com/ui/1.9.1/themes/base/ 
jquery-ui.css"> 
    <script> 
        $(document).ready(function () { 
            $('#dialog').dialog({ closeText: '<script>alert("XSS")<\/script>' }); 
        }); 
    </script>

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251