Is CVE-2021-41182 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-41182 being exploited in the wild.

How severe is CVE-2021-41182?

Low severity, with a CVSS score of 3.1, published 26 October 2021.

Which products and versions are affected?

org.webjars.npm:jquery-ui (Maven) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui (npm) SEMVER:introduced=0,fixed=1.13.0; jQuery.UI.Combined (NuGet) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=7.0.0.

Is there a fix for CVE-2021-41182?

Yes. org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.0 or later; jquery-ui (npm): upgrade to 1.13.0 or later; jQuery.UI.Combined (NuGet): upgrade to 1.13.0 or later; jquery-ui-rails (RubyGems): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-41182 attacked?

It is attacked over the network.

Am I affected by CVE-2021-41182?

Check whether you run org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-41182: jQuery UI Datepicker XSS in altField option

CVE-2021-41182 · Severity: low · CVSS 3.1 · Published 2021-10-26

jQuery UI is a popular JavaScript library that provides interactive widgets including a date picker component used on many websites. A vulnerability in the altField option allows attackers to execute arbitrary JavaScript code when a date picker is initialized with untrusted input from user-controlled sources. This can enable attackers to steal user credentials, perform actions on behalf of users, or inject malicious content into web pages.

Technologies: org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet), jquery-ui-rails (RubyGems). Vendors: Maven, npm, NuGet, RubyGems.

Quick answers

Is CVE-2021-41182 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-41182 being exploited in the wild.
How severe is CVE-2021-41182?: Low severity, with a CVSS score of 3.1, published 26 October 2021.
Which products and versions are affected?: org.webjars.npm:jquery-ui (Maven) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui (npm) SEMVER:introduced=0,fixed=1.13.0; jQuery.UI.Combined (NuGet) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=7.0.0.
Is there a fix for CVE-2021-41182?: Yes. org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.0 or later; jquery-ui (npm): upgrade to 1.13.0 or later; jQuery.UI.Combined (NuGet): upgrade to 1.13.0 or later; jquery-ui-rails (RubyGems): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-41182 attacked?: It is attacked over the network.
Am I affected by CVE-2021-41182?: Check whether you run org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.0 or later

# set org.webjars.npm:jquery-ui to 1.13.0 in your pom.xml or build.gradle

jquery-ui (npm): upgrade to 1.13.0 or later
```
npm install jquery-ui@1.13.0
```

jQuery.UI.Combined (NuGet): upgrade to 1.13.0 or later

dotnet add package jQuery.UI.Combined --version 1.13.0

jquery-ui-rails (RubyGems): upgrade to 7.0.0 or later
```
bundle update jquery-ui-rails
```

Technical details

This is a cross-site scripting (XSS) vulnerability in jQuery UI's Datepicker widget, specifically in how it handles the altField option parameter. The vulnerable component fails to sanitize or escape HTML content passed to the altField option, allowing attackers to inject arbitrary HTML and JavaScript code. The attack requires user interaction (opening/initializing the datepicker) and network reachability to a vulnerable web page, but does not require authentication. An attacker who can control the altField value—either through URL parameters, form inputs, or other untrusted sources—can execute arbitrary JavaScript in the victim's browser context. The issue is fixed in jQuery UI version 1.13.0, which now treats all string values passed to altField as CSS selectors rather than HTML content.

Affected products

jQuery UI before 1.13.0

Identifiers

CVE-2021-41182
GHSA-9gj3-hwp5-pmwc

Timeline

2021-10-26: disclosed
2021-10-26: patched: jQuery UI 1.13.0 released

References

https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.