CVE-2021-41183: jQuery UI Datepicker XSS in text options

CVE-2021-41183 · Severity: low · CVSS 3.1 · Published 2021-10-26

jQuery UI is a JavaScript library that provides interactive UI widgets, including a Datepicker calendar control used on many websites. The Datepicker widget fails to properly sanitize text options (like button labels and helper text), allowing an attacker to inject malicious scripts that execute when the calendar is initialized with untrusted configuration values. This could lead to session hijacking, credential theft, or malware distribution to website visitors.

Technologies: org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet), jquery-ui-rails (RubyGems). Vendors: Maven, npm, NuGet, RubyGems.

Quick answers

Is CVE-2021-41183 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-41183 being exploited in the wild.
How severe is CVE-2021-41183?
Low severity, with a CVSS score of 3.1, published 26 October 2021.
Which products and versions are affected?
org.webjars.npm:jquery-ui (Maven) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui (npm) SEMVER:introduced=0,fixed=1.13.0; jQuery.UI.Combined (NuGet) ECOSYSTEM:introduced=0,fixed=1.13.0; jquery-ui-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=7.0.0.
Is there a fix for CVE-2021-41183?
Yes. org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.0 or later; jquery-ui (npm): upgrade to 1.13.0 or later; jQuery.UI.Combined (NuGet): upgrade to 1.13.0 or later; jquery-ui-rails (RubyGems): upgrade to 7.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-41183 attacked?
It is attacked over the network.
Am I affected by CVE-2021-41183?
Check whether you run org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery-ui (Maven): upgrade to 1.13.0 or later
    # set org.webjars.npm:jquery-ui to 1.13.0 in your pom.xml or build.gradle
  • jquery-ui (npm): upgrade to 1.13.0 or later
    npm install jquery-ui@1.13.0
  • jQuery.UI.Combined (NuGet): upgrade to 1.13.0 or later
    dotnet add package jQuery.UI.Combined --version 1.13.0
  • jquery-ui-rails (RubyGems): upgrade to 7.0.0 or later
    bundle update jquery-ui-rails

Technical details

The vulnerability is a Cross-Site Scripting (XSS) flaw in jQuery UI's Datepicker widget. The affected *Text options (closeText, currentText, prevText, nextText, buttonText, appendText) treat their values as HTML instead of plain text, failing to escape dangerous characters. An attacker who can control these option values—for example, through a configuration API or untrusted data source—can inject JavaScript code that executes in the browser context. The attack requires no authentication and exploits user interaction (opening the datepicker), but the impact is limited to non-critical integrity issues (no data theft or confidentiality loss). The fix was released in jQuery UI 1.13.0, which treats all *Text values as plain text and properly escapes HTML.

Affected products

  • jQuery UI before 1.13.0

Identifiers

  • CVE-2021-41183
  • GHSA-j7qv-pgf6-hvh4

Timeline

  • 2021-10-25: disclosed: GitHub security advisory published
  • 2021-10-26: patched: jQuery UI 1.13.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.