CVE-2021-41182: XSS in the `altField` option of the Datepicker widget
Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: js $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function.
Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.
Workarounds A workaround is to not accept the value of the altField option from untrusted sources.
For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.
Other sources
jQuery jQuery-UI is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Datepicker widget. A remote attacker could exploit this vulnerability using the altField parameter to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41182?
CVE-2021-41182 is classified as a high-severity vulnerability due to its potential to execute untrusted code from untrusted sources.
How do I fix CVE-2021-41182?
To fix CVE-2021-41182, update your jQuery UI libraries to versions 1.13.0 or higher, or jQuery UI Rails to version 7.0.0 or higher.
What types of software are affected by CVE-2021-41182?
CVE-2021-41182 affects multiple packages including jQuery UI from various sources such as RubyGems, Maven, and npm, specifically versions below 1.13.0.
What is the exploit vector for CVE-2021-41182?
The exploit vector for CVE-2021-41182 involves setting the `altField` option of the Datepicker widget to untrusted values, potentially leading to code execution.
Are there any patches available for CVE-2021-41182?
Yes, patches are available for CVE-2021-41182 in the updated versions of jQuery UI and related packages.