Description
Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
will call the doEvilThing function.
Recommendation
Update the jquery-ui package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.13.0
- Patched version(s): 1.13.0
References
- GHSA-9gj3-hwp5-pmwc
- blog.jqueryui.com
- security.netapp.com
- lists.fedoraproject.org
- lists.debian.org
- www.drupal.org
- www.oracle.com
- www.tenable.com
- CVE-2021-41182
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
- Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
- jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label - CVE-2022-31160
- Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110
- Tags:
- npm
- jquery-ui
Anything's wrong? Let us know Last updated on September 26, 2023