{"id":"GHSA-9gj3-hwp5-pmwc","summary":"XSS in the `altField` option of the Datepicker widget in jquery-ui","details":"### Impact\nAccepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:\n```js\n$( \"#datepicker\" ).datepicker( {\n\taltField: \"\u003cimg onerror='doEvilThing()' src='/404' /\u003e\",\n} );\n```\nwill call the `doEvilThing` function.\n\n### Patches\nThe issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector.\n\n### Workarounds\nA workaround is to not accept the value of the `altField` option from untrusted sources.\n\n### For more information\nIf you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.","aliases":["BIT-drupal-2021-41182","CVE-2021-41182"],"modified":"2026-07-08T06:29:23.458833655Z","published":"2021-10-26T14:55:02Z","database_specific":{"github_reviewed":true,"nvd_published_at":"2021-10-26T15:15:00Z","severity":"MODERATE","cwe_ids":["CWE-79"],"github_reviewed_at":"2021-10-25T22:06:41Z"},"references":[{"type":"WEB","url":"https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41182"},{"type":"WEB","url":"https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63"},{"type":"WEB","url":"https://www.tenable.com/security/tns-2022-09"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"WEB","url":"https://www.drupal.org/sa-core-2022-002"},{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2022-004"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20211118-0004"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2021-41182.yml"},{"type":"PACKAGE","url":"https://github.com/jquery/jquery-ui"},{"type":"WEB","url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released"}],"affected":[{"package":{"name":"jquery-ui","ecosystem":"npm","purl":"pkg:npm/jquery-ui"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-9gj3-hwp5-pmwc/GHSA-9gj3-hwp5-pmwc.json"}},{"package":{"name":"jQuery.UI.Combined","ecosystem":"NuGet","purl":"pkg:nuget/jQuery.UI.Combined"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.12.0","1.12.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.20","1.8.20.1","1.8.21","1.8.22","1.8.23","1.8.24","1.8.9","1.9.0","1.9.0-RC1","1.9.1","1.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-9gj3-hwp5-pmwc/GHSA-9gj3-hwp5-pmwc.json"}},{"package":{"name":"jquery-ui-rails","ecosystem":"RubyGems","purl":"pkg:gem/jquery-ui-rails"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0"}]}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","0.2.2","0.3.0","0.4.0","0.4.1","0.5.0","1.0.0","1.1.0","1.1.1","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.1.0","4.1.1","4.1.2","4.2.0","4.2.1","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","6.0.0","6.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-9gj3-hwp5-pmwc/GHSA-9gj3-hwp5-pmwc.json"}},{"package":{"name":"org.webjars.npm:jquery-ui","ecosystem":"Maven","purl":"pkg:maven/org.webjars.npm/jquery-ui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}],"versions":["1.10.4","1.10.5","1.12.0","1.12.0-rc.2","1.12.1","1.13.0-rc.2","1.13.0-rc.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-9gj3-hwp5-pmwc/GHSA-9gj3-hwp5-pmwc.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}