CVE-2021-41183: XSS in `*Text` options of the Datepicker widget
Impact Accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: js $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all Text options.
Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now always treated as pure text, not HTML.
Workarounds A workaround is to not accept the value of the Text options from untrusted sources.
For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.
Other sources
jQuery jQuery-UI is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Datepicker widget. A remote attacker could exploit this vulnerability using the Text parameter to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the Text options from untrusted sources.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41183?
CVE-2021-41183 is categorized as a high severity vulnerability due to its potential to execute untrusted code.
How do I fix CVE-2021-41183?
To fix CVE-2021-41183, ensure you update to the patched versions of the affected packages such as jquery-ui-rails 7.0.0 or jQuery.UI.Combined 1.13.0.
Which applications are affected by CVE-2021-41183?
Applications using vulnerable versions of the Datepicker widget in jQuery UI are affected by CVE-2021-41183.
What are the consequences of CVE-2021-41183 if exploited?
If exploited, CVE-2021-41183 could allow an attacker to run arbitrary code within the context of the web application.
What versions of jQuery UI are vulnerable to CVE-2021-41183?
Versions of jQuery UI prior to 1.13.0 are vulnerable to CVE-2021-41183.