Executive brief
jQuery UI is a popular JavaScript library providing interactive widgets and utilities for web applications. A cross-site scripting (XSS) vulnerability in the `.position()` utility function allows arbitrary JavaScript code execution when the `of` parameter accepts untrusted input, potentially compromising user sessions, stealing sensitive data, or performing unauthorized actions on behalf of affected users.
Technical details
The vulnerability is a DOM-based cross-site scripting (XSS) flaw in the `.position()` utility function of jQuery UI. The root cause is that string values passed to the `of` option were not properly sanitized, allowing attackers to inject malicious HTML/JavaScript. An attacker can craft a malicious string containing HTML tags with event handlers (e.g., `<img onerror='doEvilThing()' />`) and supply it as the `of` parameter; when processed, the injected code executes in the user's browser context. The vulnerability requires the application to accept user-controlled input for the `of` parameter. The fix, released in jQuery UI 1.13.0, treats all string values passed to `of` as CSS selectors, preventing HTML injection.
Affected products
- jQuery Foundation jQuery UI before 1.13.0
Timeline
- 2021-10-25: disclosed: Advisory published
- 2021-10-26: patched: jQuery UI 1.13.0 released with fix