Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05Z2ozLWh3cDUtcG13Y80WtQ

XSS in the `altField` option of the Datepicker widget in jquery-ui

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:

$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );

will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Permalink: https://github.com/advisories/GHSA-9gj3-hwp5-pmwc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05Z2ozLWh3cDUtcG13Y80WtQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: 6 months ago


CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Identifiers: GHSA-9gj3-hwp5-pmwc, CVE-2021-41182
References: Repository: https://github.com/jquery/jquery-ui

Affected Packages

rubygems:jquery-ui-rails
Dependent packages: 310
Dependent repositories: 43,038
Downloads: 70,291,507 total
Affected Version Ranges: < 7.0.0
Fixed in: 7.0.0
All affected versions: 0.0.1, 0.0.2, 0.1.0, 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.4.0, 0.4.1, 0.5.0, 1.0.0, 1.1.0, 1.1.1, 2.0.0, 2.0.1, 2.0.2, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 6.0.0, 6.0.1
All unaffected versions:
maven:org.webjars.npm:jquery-ui
Dependent packages: 20
Dependent repositories: 1
Downloads:
Affected Version Ranges: < 1.13.0
Fixed in: 1.13.0
All affected versions: 1.10.4, 1.10.5, 1.12.0, 1.12.1
All unaffected versions: 1.13.0, 1.13.1, 1.13.2
nuget:jQuery.UI.Combined
Dependent packages: 0
Dependent repositories: 0
Downloads: 44,711,363 total
Affected Version Ranges: < 1.13.0
Fixed in: 1.13.0
All affected versions: 1.8.9, 1.8.10, 1.8.11, 1.8.12, 1.8.13, 1.8.14, 1.8.15, 1.8.16, 1.8.17, 1.8.18, 1.8.19, 1.8.20, 1.8.21, 1.8.22, 1.8.23, 1.8.24, 1.9.0, 1.9.1, 1.9.2, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4, 1.12.0, 1.12.1
All unaffected versions: 1.13.0, 1.13.1, 1.13.2
npm:jquery-ui
Dependent packages: 788
Dependent repositories: 21,377
Downloads: 2,241,712 last month
Affected Version Ranges: < 1.13.0
Fixed in: 1.13.0
All affected versions: 1.10.4, 1.10.5, 1.12.0, 1.12.1
All unaffected versions: 1.13.0, 1.13.1, 1.13.2