CVE-2021-41184 — Vulnerability intelligence

jqueryui — jquery ui

Published: 2021-10-26T00:00:00.000Z

CVSS

6.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Sources

• CVE-2021-41184
• Release Notes, Vendor Advisory
• Patch, Vendor Advisory
• Mitigation, Patch, Vendor Advisory
• Original advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Mailing List, Third Party Advisory
• Third Party Advisory
• Third Party Advisory
• Patch, Third Party Advisory
• Third Party Advisory
• Patch, Release Notes, Third Party Advisory
• CVE-2021-41184