CVE-2021-41183GHSA-J7QV-PGF6-HVH4BIT-DRUPAL-2021-41183
XSS in `*Text` options of the Datepicker widget
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.13.0, 7.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
Timeline
- CVE published
- Record last updated
Affected versions
- jquery jquery-ui
fixed in 1.13.0
- jquery-uinpm
fixed in 1.13.0
- org.webjars.npm:jquery-uiMaven
fixed in 1.13.0
- jquery-ui-railsRubyGems
fixed in 7.0.0
- jQuery.UI.CombinedNuGet
fixed in 1.13.0
References 18
blog.jqueryui.com
GitHub · jquery/jquery-ui
bugs.jqueryui.com
lists.fedoraproject.org
- archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ
- archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES
- archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW
- archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3
- archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4