Just wanted to give a note. Although this PR resolves the issue might not be the best approach as it would utilize a vulnerable copy of jQuery.

From the Core Trac ticket some notes;

Comment from azaozz;

Ideally plugins that replace the local copy of jQuery will be updated to not replace it, and use the patched version distributed with WP.
Also this plugin https://wordpress.org/plugins/use-google-libraries/ (which is unfortunately outdated/seems unsupported) is "doing it right". See https://plugins.trac.wordpress.org/browser/use-google-libraries/tags/1.6.2.2/use-google-libraries.php#L354.

Follow-up Comment from azaozz;

The "proper" solution would be to stop loafing the unpatched jQuery from a CDN, and load the patched version from WP.
As @desrosj pointed out above, the version in core is more secure than the one available elsewhere. #47020 was a security hardening that backported a fix from jQuery 3.4.0.