CVE-2021-41182
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `altField` option of the Datepicker widget is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `altField` option is treated as a CSS selector.
Risk Assessment
The risk is the possibility of executing malicious code in the user's browser, which could lead to data theft, session hijacking, or other attacks.
Recommendation
Update jQuery UI to version 1.13.0 or later. If not possible, avoid accepting the value of the `altField` option from untrusted sources.
Original NVD description (English source)
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.