{"id":"CVE-2021-41182","title":"jQuery-UI is the official jQuery user interface library","summary":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-79","CWE-79"],"vendor":"jqueryui","product":"jquery_ui","affected":["jquery_ui < 1.13.0","fedora = 33","fedora = 34","fedora = 35","fedora = 36","h500s_firmware","h700s_firmware","h300e_firmware","h500e_firmware","h700e_firmware","h410s_firmware","h410c_firmware","h300s_firmware","debian_linux = 9.0","drupal >= 7.0, < 7.86","communications_interactive_session_recorder = 6.4","communications_operations_monitor = 4.3","communications_operations_monitor = 4.4","communications_operations_monitor = 5.0","hospitality_suite8 >= 8.11.0, <= 8.14.0","hospitality_suite8 = 8.10.2","mysql_enterprise_monitor <= 8.0.29","primavera_unifier = 17.7","primavera_unifier = 17.8","primavera_unifier = 17.9","primavera_unifier = 17.10","primavera_unifier = 17.11","primavera_unifier = 17.12","primavera_unifier = 18.8","primavera_unifier = 19.12","primavera_unifier = 20.12","primavera_unifier = 21.12","weblogic_server = 12.2.1.3.0","weblogic_server = 12.2.1.4.0","weblogic_server = 14.1.1.0.0","tenable.sc < 5.21.0","agile_product_lifecycle_management = 9.3.6","application_express < 22.1.1","banking_platform = 2.9.0","banking_platform = 2.12.0","big_data_spatial_and_graph < 23.1","big_data_spatial_and_graph = 23.1","hospitality_inventory_management = 9.1.0","hospitality_materials_control = 18.1","jd_edwards_enterpriseone_tools <= 9.2.6.3","peoplesoft_enterprise_peopletools = 8.58","peoplesoft_enterprise_peopletools = 8.59","policy_automation >= 12.2.0, <= 12.2.25","primavera_unifier >= 17.7, <= 17.12","rest_data_services < 22.1.1","rest_data_services = 22.1.1"],"patched":["jquery_ui 1.13.0","drupal 7.86","tenable.sc 5.21.0","application_express 22.1.1","big_data_spatial_and_graph 23.1","rest_data_services 22.1.1"],"published":"2021-10-26","updated":"2026-08-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-41182","references":[{"url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/","label":"security-advisories@github.com"},{"url":"https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63","label":"security-advisories@github.com"},{"url":"https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc","label":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html","label":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/","label":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20211118-0004/","label":"security-advisories@github.com"},{"url":"https://www.drupal.org/sa-contrib-2022-004","label":"security-advisories@github.com"},{"url":"https://www.drupal.org/sa-core-2022-002","label":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"security-advisories@github.com"},{"url":"https://www.tenable.com/security/tns-2022-09","label":"security-advisories@github.com"},{"url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20211118-0004/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.drupal.org/sa-contrib-2022-004","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.drupal.org/sa-core-2022-002","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2022-09","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.39361,"epssPercentile":0.98582,"ingestedAt":"2026-08-25T17:29:31.665Z","exploits":{"github":1,"githubRepos":["https://github.com/aredspy/CVE-2021-41182-Tester"],"checkedAt":"2026-09-21T15:24:30.454Z"},"exploitAvailable":true,"slug":"CVE-2021-41182","body":"## Overview\n\njQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.\n\n## Affected\n\n- `jquery_ui < 1.13.0`\n- `fedora = 33`\n- `fedora = 34`\n- `fedora = 35`\n- `fedora = 36`\n- `h500s_firmware`\n- `h700s_firmware`\n- `h300e_firmware`\n- `h500e_firmware`\n- `h700e_firmware`\n- `h410s_firmware`\n- `h410c_firmware`\n- `h300s_firmware`\n- `debian_linux = 9.0`\n- `drupal >= 7.0, < 7.86`\n- `communications_interactive_session_recorder = 6.4`\n- `communications_operations_monitor = 4.3`\n- `communications_operations_monitor = 4.4`\n- `communications_operations_monitor = 5.0`\n- `hospitality_suite8 >= 8.11.0, <= 8.14.0`\n- `hospitality_suite8 = 8.10.2`\n- `mysql_enterprise_monitor <= 8.0.29`\n- `primavera_unifier = 17.7`\n- `primavera_unifier = 17.8`\n- `primavera_unifier = 17.9`\n- `primavera_unifier = 17.10`\n- `primavera_unifier = 17.11`\n- `primavera_unifier = 17.12`\n- `primavera_unifier = 18.8`\n- `primavera_unifier = 19.12`\n- `primavera_unifier = 20.12`\n- `primavera_unifier = 21.12`\n- `weblogic_server = 12.2.1.3.0`\n- `weblogic_server = 12.2.1.4.0`\n- `weblogic_server = 14.1.1.0.0`\n- `tenable.sc < 5.21.0`\n- `agile_product_lifecycle_management = 9.3.6`\n- `application_express < 22.1.1`\n- `banking_platform = 2.9.0`\n- `banking_platform = 2.12.0`\n- `big_data_spatial_and_graph < 23.1`\n- `big_data_spatial_and_graph = 23.1`\n- `hospitality_inventory_management = 9.1.0`\n- `hospitality_materials_control = 18.1`\n- `jd_edwards_enterpriseone_tools <= 9.2.6.3`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `peoplesoft_enterprise_peopletools = 8.59`\n- `policy_automation >= 12.2.0, <= 12.2.25`\n- `primavera_unifier >= 17.7, <= 17.12`\n- `rest_data_services < 22.1.1`\n- `rest_data_services = 22.1.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `jquery_ui 1.13.0`\n- `drupal 7.86`\n- `tenable.sc 5.21.0`\n- `application_express 22.1.1`\n- `big_data_spatial_and_graph 23.1`\n- `rest_data_services 22.1.1`","depth":"twilight","depthScore":56,"depthScoreParts":{"impact":35.8,"likelihood":7.9,"exploitation":12,"ransomware":0},"changes":[{"seq":4541,"id":"CVE-2021-41182","ts":1788887189378,"field":"exploit_available","old":"false","new":"true"},{"seq":3424,"id":"CVE-2021-41182","ts":1788886306662,"field":"exploit_available","old":"true","new":"false"},{"seq":2279,"id":"CVE-2021-41182","ts":1788882976397,"field":"exploit_available","old":"false","new":"true"},{"seq":1308,"id":"CVE-2021-41182","ts":1788882388332,"field":"exploit_available","old":"true","new":"false"},{"seq":422,"id":"CVE-2021-41182","ts":1788881823606,"field":"exploit_available","old":"false","new":"true"}]}