PT-2021-23157 · Jquery+5 · Jquery Ui+5

Published 2021-10-26 · Updated 2025-11-10 · CVE-2021-41183

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions jQuery UI versions prior to 1.13.0

Description Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker with options such as closeText, currentText, prevText, nextText, buttonText, or appendText set to untrusted input can lead to code execution. The issue is fixed in jQuery UI 1.13.0, where the values passed to these options are now treated as pure text, not HTML.

Recommendations For versions prior to 1.13.0, a workaround is to not accept the value of the *Text options from untrusted sources. Update to jQuery UI 1.13.0 or later to fix the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-6282

ALT-PU-2023-6850

BIT-DRUPAL-2021-41183

CVE-2021-41183

DLA-2889-1

DLA-3230-1

DLA-3551-1

GHSA-J7QV-PGF6-HVH4

OESA-2022-1693

RHSA-2022:4711

SUSE-SU-2022:1729-1

USN-6419-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Ubuntu

Jquery Ui

References · 91

• 🔥 https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4 · Exploit
• 🔥 https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023 · Exploit
• 🔥 https://github.com/gabrielolivra/Exploit-Medium-CVE-2021-41184 · Exploit
• 🔥 https://github.com/ossf-cve-benchmark/CVE-2020-11022 · Exploit
• https://github.com/jquery/jquery-ui/pull/1953 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3 · Vendor Advisory
• https://tenable.com/security/tns-2022-09 · Patch
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41183 · Security Note
• https://bugs.jqueryui.com/ticket/15284 · Vendor Advisory