XSS in `*Text` options of the Datepicker widget in jquery-ui

Description

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:

will call doEvilThing with 6 different parameters coming from all *Text options.

Recommendation

Update the jquery-ui package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.13.0
• Patched version(s): 1.13.0

References

• GHSA-j7qv-pgf6-hvh4
• blog.jqueryui.com
• bugs.jqueryui.com
• security.netapp.com
• lists.fedoraproject.org
• lists.debian.org
• www.drupal.org
• www.oracle.com
• www.tenable.com
• CVE-2021-41183
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6