CVE-2021-41184
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `of` option of the `.position()` utility is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `of` option is treated as a CSS selector.
Risk Assessment
The risk is the possibility of executing malicious code in the user's browser, which could lead to data theft, session hijacking, or other attacks.
Recommendation
Update jQuery UI to version 1.13.0 or later. If not possible, avoid accepting the value of the `of` option from untrusted sources.
Original NVD description (English source)
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.