CVE-2021-41183
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the values of various `*Text` options of the Datepicker widget are accepted from untrusted sources. The issue is fixed in 1.13.0, where values passed to various `*Text` options are always treated as pure text, not HTML.
Risk Assessment
The risk is the possibility of executing malicious code in the user's browser, which could lead to data theft, session hijacking, or other attacks.
Recommendation
Update jQuery UI to version 1.13.0 or later. If not possible, avoid accepting the values of the `*Text` options from untrusted sources.
Other vulnerabilities in jQuery UI
See all- CVE-2021-41184Medium
jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `of` option of the `.position()` utility is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `of` option is treated as a CSS selector.
- CVE-2021-41182Medium
jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `altField` option of the Datepicker widget is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `altField` option is treated as a CSS selector.
Original NVD description (English source)
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS