CVE-2021-41184: XSS in the `of` option of the `.position()` util in jquery-ui
Summary
CVE-2021-41184: XSS in the of option of the .position() util in jquery-ui. Affects jquery-ui versions < 1.13.0. Fixed in 1.13.0. How to fix ↓
Also tracked for
The same CVE-2021-41184 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The jquery-ui package is a popular JavaScript library that provides a set of user interface interactions, effects, widgets, and themes for building web applications. It is commonly used to enhance the functionality and visual appeal of websites. However, the package is vulnerable to a cross-site scripting (XSS) vulnerability in the of option of the .position() utility. This option allows developers to specify the element relative to which the positioned element should be placed. By accepting untrusted input as the value of the of option, an attacker can inject malicious code that will be executed when the utility is invoked.
Vulnerability Detail
The XSS vulnerability in the of option of the .position() utility in jquery-ui allows an attacker to execute arbitrary code in the context of the vulnerable application. By providing a crafted value for the of option, an attacker can trigger the execution of malicious JavaScript code. This can lead to various security issues, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the website. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.13.0
This is the first release that contains the fix.
npm install jquery-ui@1.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to not accept the value of the of option from untrusted sources. Developers should carefully validate and sanitize any user input before using it as the value of the of option. By implementing proper input validation and sanitization, the risk of XSS attacks can be significantly reduced.
Conclusion
The XSS vulnerability in the of option of the .position() utility in jquery-ui can have serious security implications for web applications. It is crucial for developers to update their jquery-ui package to version 1.13.0 or newer to apply the necessary patch. Additionally, implementing proper input validation and sanitization practices can help mitigate the risk of XSS attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for jquery-ui →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of the vulnerable application, potentially leading to sensitive data theft, unauthorized actions, or website defacement.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this XSS vulnerability in jquery-ui.
Yes, the vulnerability has been fixed in jQuery UI 1.13.0. Developers should update their jquery-ui package to the latest version to apply the patch.
A workaround is to not accept the value of the of option from untrusted sources. Developers should validate and sanitize any user input before using it as the value of the of option.
If you have any further questions or comments about this vulnerability, you can search for a relevant issue in the jQuery UI repository on GitHub. If you don't find an answer, you can open a new issue to seek assistance from the community.
References
Related vulnerabilities
Recent vulnerabilities recorded for jquery-ui.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
