Description
Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.
jQuery-UI is a library for manipulating UI elements via jQuery.
Version 1.11.
Recommendation
Update the jquery-ui package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.12.0
- Patched version(s): 1.12.0
References
- GHSA-hpcf-8vf9-q4gj
- jqueryui.com
- lists.apache.org
- lists.fedoraproject.org
- security.netapp.com
- www.oracle.com
- rhn.redhat.com
- lists.debian.org
- www.drupal.org
- web.archive.org
- CVE-2016-7103
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303
- Cross-site Scripting in jquery-ui - CVE-2010-5312
- Joplin Cross-site Scripting vulnerability (GHSA-7grw-xfx6-qhx6) - CVE-2023-37298
- jquery-ui Tooltip widget vulnerable to XSS - CVE-2012-6662
- Tags:
- npm
- jquery-ui
Anything's wrong? Let us know Last updated on September 26, 2023