CVE-2021-41184: XSS in the `of` option of the `.position()` util

First published: Mon Oct 25 2021(Updated: )

### Impact Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following code: ```js $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); ``` will call the `doEvilThing()` function. ### Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. ### Workarounds A workaround is to not accept the value of the `of` option from untrusted sources. ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.

Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/github-advisory-latest
• alias/GHSA-gpqq-952q-5327
• alias/CVE-2021-41184
• collector/github-advisory
• collector/redhat-cve
• agent/type
• agent/first-publish-date
• agent/remedy
• collector/launchpad-cve
• source/Launchpad
• collector/redhat-bugzilla
• source/Red Hat
• agent/author
• agent/severity
• agent/weakness
• agent/description
• collector/nvd-cve
• source/NVD
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• collector/nvd-index
• collector/nvd-api
• collector/security-tracker-debian
• source/Debian
• agent/softwarecombine
• agent/references
• collector/ibm-support
• source/IBM
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/title
• agent/event
• agent/tags
• collector/usn-cve
• source/Ubuntu
• package-manager/rubygems
• package-manager/nuget
• package-manager/maven
• package-manager/npm
• vendor/jqueryui
• canonical/jqueryui jquery ui jquery
• vendor/fedoraproject
• canonical/fedoraproject fedora
• version/fedoraproject fedora/33
• version/fedoraproject fedora/34
• version/fedoraproject fedora/35
• version/fedoraproject fedora/36
• vendor/netapp
• canonical/netapp h300s firmware
• canonical/netapp h300s
• canonical/netapp h500s firmware
• canonical/netapp h500s
• canonical/netapp h700s firmware
• canonical/netapp h700s
• canonical/netapp h300e firmware
• canonical/netapp h300e
• canonical/netapp h500e firmware
• canonical/netapp h500e
• canonical/netapp h700e firmware
• canonical/netapp h700e
• canonical/netapp h410s firmware
• canonical/netapp h410s
• canonical/netapp h410c firmware
• canonical/netapp h410c
• vendor/drupal
• canonical/drupal drupal
• version/drupal drupal/7.0
• version/drupal drupal/9.2.0
• version/drupal drupal/9.3.0
• vendor/tenable
• canonical/tenable tenable.sc
• vendor/oracle
• canonical/oracle agile plm
• version/oracle agile plm/9.3.6
• canonical/oracle application express
• canonical/oracle banking platform
• version/oracle banking platform/2.9.0
• version/oracle banking platform/2.12.0
• canonical/oracle big data spatial and graph
• version/oracle big data spatial and graph/23.1
• canonical/oracle communications interactive session recorder
• version/oracle communications interactive session recorder/6.4
• canonical/oracle communications operations monitor
• version/oracle communications operations monitor/4.3
• version/oracle communications operations monitor/4.4
• version/oracle communications operations monitor/5.0
• canonical/oracle hospitality inventory management
• version/oracle hospitality inventory management/9.1.0
• canonical/oracle hospitality materials control
• version/oracle hospitality materials control/18.1
• canonical/oracle hospitality suite8
• version/oracle hospitality suite8/8.11.0
• version/oracle hospitality suite8/8.14.0
• version/oracle hospitality suite8/8.10.2
• canonical/oracle jd edwards enterpriseone tools
• version/oracle jd edwards enterpriseone tools/9.2.6.3
• canonical/oracle peoplesoft enterprise peopletools
• version/oracle peoplesoft enterprise peopletools/8.58
• version/oracle peoplesoft enterprise peopletools/8.59
• canonical/oracle policy automation
• version/oracle policy automation/12.2.0
• version/oracle policy automation/12.2.25
• canonical/oracle primavera unifier
• version/oracle primavera unifier/17.7
• version/oracle primavera unifier/17.12
• version/oracle primavera unifier/18.8
• version/oracle primavera unifier/19.12
• version/oracle primavera unifier/20.12
• version/oracle primavera unifier/21.12
• canonical/oracle rest data services
• version/oracle rest data services/22.1.1
• canonical/oracle weblogic server
• version/oracle weblogic server/12.2.1.3.0
• version/oracle weblogic server/12.2.1.4.0
• version/oracle weblogic server/14.1.1.0.0
• package-manager/debian
• vendor/ibm
• canonical/ibm qradar siem
• version/ibm qradar siem/7.5.0 ga
• version/ibm qradar siem/7.4.3 ga - 7.4.3 fp4
• version/ibm qradar siem/7.3.3 ga - 7.3.3 fp10