# CVE-2021-41182: jQuery UI Datepicker XSS in altField option

Source: https://junglewise.ai/threats/cve-2021-41182-jquery-ui-datepicker-xss-in-altfield-option  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-10-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-41182 · Severity: low · CVSS 3.1 · Published 2021-10-26

jQuery UI is a popular JavaScript library that provides interactive widgets including a date picker component used on many websites. A vulnerability in the altField option allows attackers to execute arbitrary JavaScript code when a date picker is initialized with untrusted input from user-controlled sources. This can enable attackers to steal user credentials, perform actions on behalf of users, or inject malicious content into web pages.

Technologies: [org.webjars.npm:jquery-ui (Maven)](https://junglewise.ai/threats/technologies/org-webjars-npm-jquery-ui), [jquery-ui (npm)](https://junglewise.ai/threats/technologies/jquery-ui), [jQuery.UI.Combined (NuGet)](https://junglewise.ai/threats/technologies/jquery-ui-combined), [jquery-ui-rails (RubyGems)](https://junglewise.ai/threats/technologies/jquery-ui-rails). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [npm](https://junglewise.ai/threats/vendors/npm), [NuGet](https://junglewise.ai/threats/vendors/nuget), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2021-41182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-41182 being exploited in the wild.

**How severe is CVE-2021-41182?** Low severity, with a CVSS score of 3.1, published 26 October 2021.

**Which products and versions are affected?** org.webjars.npm:jquery-ui (Maven) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui (npm) SEMVER:introduced=0,fixed=1.13.0; jQuery.UI.Combined (NuGet) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=7.0.0.

**Is there a fix for CVE-2021-41182?** Yes. org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.0 or later; jquery-ui (npm): upgrade to 1.13.0 or later; jQuery.UI.Combined (NuGet): upgrade to 1.13.0 or later; jquery-ui-rails (RubyGems): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-41182 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-41182?** Check whether you run org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.0 or later

  ```sh
  # set org.webjars.npm:jquery-ui to 1.13.0 in your pom.xml or build.gradle
  ```

- jquery-ui (npm): upgrade to 1.13.0 or later

  ```sh
  npm install jquery-ui@1.13.0
  ```

- jQuery.UI.Combined (NuGet): upgrade to 1.13.0 or later

  ```sh
  dotnet add package jQuery.UI.Combined --version 1.13.0
  ```

- jquery-ui-rails (RubyGems): upgrade to 7.0.0 or later

  ```sh
  bundle update jquery-ui-rails
  ```


## Technical details

This is a cross-site scripting (XSS) vulnerability in jQuery UI's Datepicker widget, specifically in how it handles the altField option parameter. The vulnerable component fails to sanitize or escape HTML content passed to the altField option, allowing attackers to inject arbitrary HTML and JavaScript code. The attack requires user interaction (opening/initializing the datepicker) and network reachability to a vulnerable web page, but does not require authentication. An attacker who can control the altField value—either through URL parameters, form inputs, or other untrusted sources—can execute arbitrary JavaScript in the victim's browser context. The issue is fixed in jQuery UI version 1.13.0, which now treats all string values passed to altField as CSS selectors rather than HTML content.

## Affected products

- jQuery UI before 1.13.0

## Identifiers

- CVE-2021-41182
- GHSA-9gj3-hwp5-pmwc

## Timeline

- 2021-10-26: disclosed
- 2021-10-26: patched: jQuery UI 1.13.0 released

## References

- [https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc](https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc)

## Related threats

- [jQuery UI XSS in checkboxradio refresh with HTML-like label text](https://junglewise.ai/threats/cve-2022-31160-jquery-ui-xss-in-checkboxradio-refresh-with-html-like-label-text)
- [jQuery UI Datepicker XSS in text options](https://junglewise.ai/threats/cve-2021-41183-jquery-ui-datepicker-xss-in-text-options)
- [jQuery UI XSS in position() method](https://junglewise.ai/threats/cve-2021-41184-jquery-ui-xss-in-position-method)
- [jQuery UI cross-site scripting in dialog closeText parameter](https://junglewise.ai/threats/jquery-ui-cross-site-scripting-in-dialog-closetext-parameter-65aa5ef7)
- [jQuery UI cross-site scripting in Dialog title](https://junglewise.ai/threats/cve-2010-5312-jquery-ui-cross-site-scripting-in-dialog-title)