CVE-2021-41183mediumCWE-79

CVE-2021-41183: medium-severity vulnerability in jquery-ui

XSS in `*Text` options of the Datepicker widget

Published · Updated

Follow this CVE+ Monitor jquery-ui+ Monitor drupal7

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 8.5%
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
jquery · jquery-ui
Related CVEs — jquery-ui

In the same product, most dangerous first.

CVE-2021-41184MEDIUMXSS in the `of` option of the `.position()` utilEPSS 40.8%CVE-2021-41182MEDIUMXSS in the `altField` option of the Datepicker widgetEPSS 39.4%CVE-2022-31160MEDIUMjQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelEPSS 2.7%