Description
Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
will call doEvilThing with 6 different parameters coming from all *Text options.
Recommendation
Update the jquery-ui package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.13.0
- Patched version(s): 1.13.0
References
- GHSA-j7qv-pgf6-hvh4
- blog.jqueryui.com
- bugs.jqueryui.com
- security.netapp.com
- lists.fedoraproject.org
- lists.debian.org
- www.drupal.org
- www.oracle.com
- www.tenable.com
- CVE-2021-41183
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- @digitalocean/do-markdownit has Type Confusion vulnerability - CVE-2025-59717
- jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label - CVE-2022-31160
- Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
- Cross-site Scripting in jquery-ui - CVE-2010-5312
- Tags:
- npm
- jquery-ui
Anything's wrong? Let us know Last updated on September 26, 2023