WordPress v5.2.2 ships with a patched version of jQuery v1.12.4, with backports from 3.4.0; however, it is difficult to verify that the fixes have been applied.
Two flaws found for jQuery v1.12.4 via Snyk:
Commit: https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b