CVE-2021-41183: XSS in `*Text` options of the Datepicker widget

First published: Mon Oct 25 2021(Updated: )

### Impact Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); ``` will call `doEvilThing` with 6 different parameters coming from all `*Text` options. ### Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. ### Workarounds A workaround is to not accept the value of the `*Text` options from untrusted sources. ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.

Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/github-advisory-latest
• alias/GHSA-j7qv-pgf6-hvh4
• alias/CVE-2021-41183
• collector/github-advisory
• collector/redhat-cve
• agent/type
• collector/launchpad-cve
• source/Launchpad
• collector/redhat-bugzilla
• source/Red Hat
• agent/first-publish-date
• agent/remedy
• agent/severity
• agent/weakness
• agent/author
• collector/nvd-api
• agent/software-canonical-lookup-request
• collector/nvd-cve
• source/NVD
• agent/software-canonical-lookup
• collector/nvd-index
• collector/security-tracker-debian
• source/Debian
• agent/description
• agent/softwarecombine
• agent/references
• collector/ibm-support
• source/IBM
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/title
• agent/event
• agent/tags
• collector/usn-cve
• source/Ubuntu
• package-manager/rubygems
• package-manager/nuget
• package-manager/maven
• package-manager/npm
• vendor/jqueryui
• canonical/jqueryui jquery ui jquery
• vendor/fedoraproject
• canonical/fedoraproject fedora
• version/fedoraproject fedora/33
• version/fedoraproject fedora/34
• version/fedoraproject fedora/35
• version/fedoraproject fedora/36
• vendor/netapp
• canonical/netapp h300s firmware
• canonical/netapp h300s
• canonical/netapp h500s firmware
• canonical/netapp h500s
• canonical/netapp h700s firmware
• canonical/netapp h700s
• canonical/netapp h300e firmware
• canonical/netapp h300e
• canonical/netapp h500e firmware
• canonical/netapp h500e
• canonical/netapp h700e firmware
• canonical/netapp h700e
• canonical/netapp h410s firmware
• canonical/netapp h410s
• canonical/netapp h410c firmware
• canonical/netapp h410c
• vendor/debian
• canonical/debian debian linux
• version/debian debian linux/9.0
• vendor/drupal
• canonical/drupal drupal
• version/drupal drupal/7.0
• version/drupal drupal/9.2.0
• version/drupal drupal/9.3.0
• vendor/oracle
• canonical/oracle agile plm
• version/oracle agile plm/9.3.6
• canonical/oracle application express
• canonical/oracle banking platform
• version/oracle banking platform/2.9.0
• version/oracle banking platform/2.12.0
• canonical/oracle big data spatial and graph
• version/oracle big data spatial and graph/23.1
• canonical/oracle communications interactive session recorder
• version/oracle communications interactive session recorder/6.4
• canonical/oracle communications operations monitor
• version/oracle communications operations monitor/4.3
• version/oracle communications operations monitor/4.4
• version/oracle communications operations monitor/5.0
• canonical/oracle hospitality inventory management
• version/oracle hospitality inventory management/9.1.0
• canonical/oracle hospitality suite8
• version/oracle hospitality suite8/8.11.0
• version/oracle hospitality suite8/11.14.0
• version/oracle hospitality suite8/8.10.2
• canonical/oracle jd edwards enterpriseone tools
• version/oracle jd edwards enterpriseone tools/9.2.6.3
• canonical/oracle mysql enterprise monitor
• version/oracle mysql enterprise monitor/8.0.29
• canonical/oracle peoplesoft enterprise peopletools
• version/oracle peoplesoft enterprise peopletools/8.58
• version/oracle peoplesoft enterprise peopletools/8.59
• canonical/oracle policy automation
• version/oracle policy automation/12.2.0
• version/oracle policy automation/12.2.5
• canonical/oracle primavera gateway
• version/oracle primavera gateway/17.7
• version/oracle primavera gateway/17.12
• version/oracle primavera gateway/18.8.0
• version/oracle primavera gateway/19.12.0
• version/oracle primavera gateway/20.12.0
• version/oracle primavera gateway/21.12.0
• canonical/oracle rest data services
• version/oracle rest data services/22.1.1
• canonical/oracle weblogic server
• version/oracle weblogic server/12.2.1.3.0
• version/oracle weblogic server/12.2.1.4.0
• version/oracle weblogic server/14.1.1.0.0
• vendor/tenable
• canonical/tenable tenable.sc
• package-manager/debian
• vendor/ibm
• canonical/ibm qradar siem
• version/ibm qradar siem/7.5.0 ga
• version/ibm qradar siem/7.4.3 ga - 7.4.3 fp4
• version/ibm qradar siem/7.3.3 ga - 7.3.3 fp10