jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label

Description

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

Recommendation

Update the jquery-ui package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.13.2
• Patched version(s): 1.13.2

References

• GHSA-h6gj-6jjq-h8g9
• www.drupal.org
• lists.debian.org
• blog.jqueryui.com
• lists.fedoraproject.org
• security.netapp.com
• CVE-2022-31160
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• x402 SDK vulnerable in outdated versions in resource servers for builders (GHSA-3j63-5h8p-gf7c) 3 - Vulnerability
• Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
• Cross-site Scripting in jquery-ui - CVE-2010-5312
• Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361

Tags:

npm

jquery-ui