Description
Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
will call the doEvilThing function.
Recommendation
Update the jquery-ui package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.13.0
- Patched version(s): 1.13.0
References
- GHSA-9gj3-hwp5-pmwc
- blog.jqueryui.com
- security.netapp.com
- lists.fedoraproject.org
- lists.debian.org
- www.drupal.org
- www.oracle.com
- www.tenable.com
- CVE-2021-41182
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Bootstrap Cross-site Scripting vulnerability (GHSA-pj7m-g53m-7638) - CVE-2018-14041
- angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
- Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
- @astrojs/node's trailing slash handling causes open redirect issue - CVE-2025-55207
- Tags:
- npm
- jquery-ui
Anything's wrong? Let us know Last updated on September 26, 2023