{"schema_version":"1.9.0","id":"GHSA-j7qv-pgf6-hvh4","published":"2021-10-26T14:55:21Z","modified":"2026-07-08T06:27:53.914646565Z","aliases":["BIT-drupal-2021-41183","CVE-2021-41183"],"summary":"XSS in `*Text` options of the Datepicker widget in jquery-ui","details":"### Impact\nAccepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:\n```js\n$( \"#datepicker\" ).datepicker( {\n\tshowButtonPanel: true,\n\tshowOn: \"both\",\n\tcloseText: \"<script>doEvilThing( 'closeText XSS' )</script>\",\n\tcurrentText: \"<script>doEvilThing( 'currentText XSS' )</script>\",\n\tprevText: \"<script>doEvilThing( 'prevText XSS' )</script>\",\n\tnextText: \"<script>doEvilThing( 'nextText XSS' )</script>\",\n\tbuttonText: \"<script>doEvilThing( 'buttonText XSS' )</script>\",\n\tappendText: \"<script>doEvilThing( 'appendText XSS' )</script>\",\n} );\n```\nwill call `doEvilThing` with 6 different parameters coming from all `*Text` options.\n\n### Patches\nThe issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML.\n\n### Workarounds\nA workaround is to not accept the value of the `*Text` options from untrusted sources.\n\n### For more information\nIf you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.","affected":[{"package":{"name":"jquery-ui","ecosystem":"npm","purl":"pkg:npm/jquery-ui"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-j7qv-pgf6-hvh4/GHSA-j7qv-pgf6-hvh4.json"}},{"package":{"name":"org.webjars.npm:jquery-ui","ecosystem":"Maven","purl":"pkg:maven/org.webjars.npm/jquery-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"versions":["1.10.4","1.10.5","1.12.0","1.12.0-rc.2","1.12.1","1.13.0-rc.2","1.13.0-rc.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-j7qv-pgf6-hvh4/GHSA-j7qv-pgf6-hvh4.json"}},{"package":{"name":"jquery-ui-rails","ecosystem":"RubyGems","purl":"pkg:gem/jquery-ui-rails"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0"}]}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","0.2.2","0.3.0","0.4.0","0.4.1","0.5.0","1.0.0","1.1.0","1.1.1","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.1.0","4.1.1","4.1.2","4.2.0","4.2.1","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","6.0.0","6.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-j7qv-pgf6-hvh4/GHSA-j7qv-pgf6-hvh4.json"}},{"package":{"name":"jQuery.UI.Combined","ecosystem":"NuGet","purl":"pkg:nuget/jQuery.UI.Combined"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.12.0","1.12.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.20","1.8.20.1","1.8.21","1.8.22","1.8.23","1.8.24","1.8.9","1.9.0","1.9.0-RC1","1.9.1","1.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-j7qv-pgf6-hvh4/GHSA-j7qv-pgf6-hvh4.json"}}],"references":[{"type":"WEB","url":"https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41183"},{"type":"WEB","url":"https://github.com/jquery/jquery-ui/pull/1953"},{"type":"WEB","url":"https://www.tenable.com/security/tns-2022-09"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"WEB","url":"https://www.drupal.org/sa-core-2022-002"},{"type":"WEB","url":"https://www.drupal.org/sa-core-2022-001"},{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2022-004"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20211118-0004"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html"},{"type":"PACKAGE","url":"https://github.com/jquery/jquery-ui"},{"type":"WEB","url":"https://bugs.jqueryui.com/ticket/15284"},{"type":"WEB","url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2021-10-25T22:06:45Z","nvd_published_at":"2021-10-26T15:15:00Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}