CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2021-41183
Medium (6.1). EPSS 8.5% chance of exploitation in the next 30 days. Fixed in jquery-ui 1.13.0.
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
Severity
- EPSS
- 8.5% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- drupal:drupal
- fedoraproject:fedora
- jqueryui:jquery_ui
- netapp:h300e_firmware
- netapp:h300s_firmware
- netapp:h410c_firmware
- netapp:h410s_firmware
- netapp:h500e_firmware
- netapp:h500s_firmware
- netapp:h700e_firmware
- netapp:h700s_firmware
- oracle:agile_product_lifecycle_management
- oracle:application_express
- oracle:banking_platform
- oracle:big_data_spatial_and_graph
- oracle:communications_interactive_session_recorder
- oracle:communications_operations_monitor
- oracle:hospitality_inventory_management
- oracle:hospitality_suite8
- oracle:jd_edwards_enterpriseone_tools
- oracle:mysql_enterprise_monitor
- oracle:peoplesoft_enterprise_peopletools
- oracle:policy_automation
- oracle:primavera_gateway
- oracle:rest_data_services
- oracle:weblogic_server
- tenable:tenable.sc
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j7qv-pgf6-hvh4 | npm | jquery-ui | <1.13.0 | 1.13.0 |
| GHSA-j7qv-pgf6-hvh4 | Maven | org.webjars.npm:jquery-ui | <1.13.0 | 1.13.0 |
| GHSA-j7qv-pgf6-hvh4 | RubyGems | jquery-ui-rails | <7.0.0 | 7.0.0 |
| GHSA-j7qv-pgf6-hvh4 | NuGet | jQuery.UI.Combined | <1.13.0 | 1.13.0 |