Description
Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
will call the doEvilThing() function.
Recommendation
Update the jquery-ui package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.13.0
- Patched version(s): 1.13.0
References
- GHSA-gpqq-952q-5327
- blog.jqueryui.com
- security.netapp.com
- lists.fedoraproject.org
- www.drupal.org
- www.oracle.com
- www.tenable.com
- lists.debian.org
- CVE-2021-41184
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- The AuthKit Remix Library renders sensitive auth data in HTML - CVE-2025-55009
- NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies - CVE-2025-48947
- Strapi allows Server-Side Request Forgery in Webhook function - CVE-2024-52588
- Cross-site Scripting in jquery-ui - CVE-2010-5312
- Tags:
- npm
- jquery-ui
Anything's wrong? Let us know Last updated on October 05, 2023