Executive brief
jQuery UI is a widely-used JavaScript library that provides interactive UI components for web applications. A cross-site scripting (XSS) vulnerability in the dialog function allows attackers to inject malicious scripts or HTML through the closeText parameter, potentially compromising user sessions, stealing data, or manipulating page content in affected applications.
Technical details
This is a cross-site scripting (XSS) vulnerability in jQuery UI's dialog function. The closeText parameter fails to properly sanitize user-supplied input, allowing remote attackers to inject arbitrary HTML or JavaScript code. The vulnerability affects all versions prior to 1.12.0. An attacker can exploit this by providing a specially crafted closeText value when initializing a dialog, which would execute in the context of the user's browser. The vulnerability was patched in jQuery UI 1.12.0 and corresponding versions of dependent packages (jquery-ui-rails 6.0.0, jQuery.UI.Combined 1.12.0).
Affected products
- jQuery Foundation jQuery UI before 1.12.0
- NuGet jQuery.UI.Combined before 1.12.0
- RubyGems jquery-ui-rails before 6.0.0
Timeline
- 2018-07-27: disclosed: Published to GitHub Advisory Database
- 2020-06-16: other: Advisory withdrawn as accidental duplicate publish