CVE-2021-41184

6.1 mediumEPSS 41%

Medium (6.1). EPSS 41% chance of exploitation in the next 30 days. Fixed in jquery-ui 1.13.0.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 41% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-10-26
Modified: 2026-08-25
Record from: the NVD, synced 2026-10-19

Affected

drupal:drupal
fedoraproject:fedora
jqueryui:jquery_ui
netapp:h300e_firmware
netapp:h300s_firmware
netapp:h410c_firmware
netapp:h410s_firmware
netapp:h500e_firmware
netapp:h500s_firmware
netapp:h700e_firmware
netapp:h700s_firmware
oracle:agile_product_lifecycle_management
oracle:application_express
oracle:banking_platform
oracle:big_data_spatial_and_graph
oracle:communications_interactive_session_recorder
oracle:communications_operations_monitor
oracle:hospitality_inventory_management
oracle:hospitality_materials_control
oracle:hospitality_suite8
oracle:jd_edwards_enterpriseone_tools
oracle:peoplesoft_enterprise_peopletools
oracle:policy_automation
oracle:primavera_unifier
oracle:rest_data_services
oracle:weblogic_server
tenable:tenable.sc

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-gpqq-952q-5327	npm	jquery-ui	<1.13.0	1.13.0
GHSA-gpqq-952q-5327	Maven	org.webjars.npm:jquery-ui	<1.13.0	1.13.0
GHSA-gpqq-952q-5327	NuGet	jQuery.UI.Combined	<1.13.0	1.13.0
GHSA-gpqq-952q-5327	RubyGems	jquery-ui-rails	<7.0.0	7.0.0

References

Check your stack JSON