CVE-2021-41183
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the values of various `*Text` options of the Datepicker widget are accepted from untrusted sources. The issue is fixed in 1.13.0, where values passed to various `*Text` options are always treated as pure text, not HTML.
Risk Assessment
The risk is the possibility of executing malicious code in the user's browser, which could lead to data theft, session hijacking, or other attacks.
Recommendation
Update jQuery UI to version 1.13.0 or later. If not possible, avoid accepting the values of the `*Text` options from untrusted sources.
Original NVD description (English source)
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.