XSS in the `altField` option of the Datepicker widget in jquery-ui

Description

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:

will call the doEvilThing function.

Recommendation

Update the jquery-ui package to the latest compatible version. Followings are version details:

Affected version(s): < 1.13.0
Patched version(s): 1.13.0

References

GHSA-9gj3-hwp5-pmwc
blog.jqueryui.com
security.netapp.com
lists.fedoraproject.org
lists.debian.org
www.drupal.org
www.oracle.com
www.tenable.com
CVE-2021-41182
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for XSS in the `altField` option of the Datepicker widget in jquery-ui and gives you actionable findings to investigate.

Start a free scan

Related Issues

XSS in `*Text` options of the Datepicker widget in jquery-ui - CVE-2021-41183
XSS in the `of` option of the `.position()` util in jquery-ui - CVE-2021-41184
jquery-ui Tooltip widget vulnerable to XSS - CVE-2012-6662
jquery.terminal self XSS on user input - CVE-2021-43862

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated September 26, 2023