CVE-2021-41184

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Affected products

Alt Linux, Astra Linux, Debian, Linuxmint, Ubuntu, Jquery Ui

Jqueryui Jquery Ui

< 1.13.0

Fix

Available

CVSS 3.1

6.5 MEDIUM

EPSS

40.8% (99th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2021-10-26