CVE-2021-41182mediumCWE-79

CVE-2021-41182: medium-severity vulnerability in jquery-ui

XSS in the `altField` option of the Datepicker widget

Published · Updated

Follow this CVE+ Monitor jquery-ui+ Monitor drupal7

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 39%
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
jquery · jquery-ui
Related CVEs — jquery-ui

In the same product, most dangerous first.

CVE-2021-41184MEDIUMXSS in the `of` option of the `.position()` utilEPSS 40.8%CVE-2021-41183MEDIUMXSS in `*Text` options of the Datepicker widgetEPSS 8.5%CVE-2022-31160MEDIUMjQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelEPSS 2.7%