{"id":"CVE-2021-41183","title":"jQuery-UI is the official jQuery user interface library","summary":"jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-79","CWE-79"],"vendor":"jqueryui","product":"jquery_ui","affected":["jquery_ui < 1.13.0","fedora = 33","fedora = 34","fedora = 35","fedora = 36","h300s_firmware","h500s_firmware","h700s_firmware","h300e_firmware","h500e_firmware","h700e_firmware","h410s_firmware","h410c_firmware","debian_linux = 9.0","drupal >= 7.0, < 7.86","drupal >= 9.2.0, < 9.2.11","drupal >= 9.3.0, < 9.3.3","agile_product_lifecycle_management = 9.3.6","application_express < 22.1.1","banking_platform = 2.9.0","banking_platform = 2.12.0","big_data_spatial_and_graph < 23.1","big_data_spatial_and_graph = 23.1","communications_interactive_session_recorder = 6.4","communications_operations_monitor = 4.3","communications_operations_monitor = 4.4","communications_operations_monitor = 5.0","hospitality_inventory_management = 9.1.0","hospitality_suite8 >= 8.11.0, <= 11.14.0","hospitality_suite8 = 8.10.2","jd_edwards_enterpriseone_tools <= 9.2.6.3","mysql_enterprise_monitor <= 8.0.29","peoplesoft_enterprise_peopletools = 8.58","peoplesoft_enterprise_peopletools = 8.59","policy_automation >= 12.2.0, <= 12.2.5","primavera_gateway >= 17.7, <= 17.12","primavera_gateway = 18.8.0","primavera_gateway = 19.12.0","primavera_gateway = 20.12.0","primavera_gateway = 21.12.0","rest_data_services < 22.1.1","rest_data_services = 22.1.1","weblogic_server = 12.2.1.3.0","weblogic_server = 12.2.1.4.0","weblogic_server = 14.1.1.0.0","tenable.sc < 5.21.0"],"patched":["jquery_ui 1.13.0","drupal 9.3.3","application_express 22.1.1","big_data_spatial_and_graph 23.1","rest_data_services 22.1.1","tenable.sc 5.21.0"],"published":"2021-10-26","updated":"2026-08-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-41183","references":[{"url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/","label":"security-advisories@github.com"},{"url":"https://bugs.jqueryui.com/ticket/15284","label":"security-advisories@github.com"},{"url":"https://github.com/jquery/jquery-ui/pull/1953","label":"security-advisories@github.com"},{"url":"https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4","label":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html","label":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/","label":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/","label":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20211118-0004/","label":"security-advisories@github.com"},{"url":"https://www.drupal.org/sa-contrib-2022-004","label":"security-advisories@github.com"},{"url":"https://www.drupal.org/sa-core-2022-001","label":"security-advisories@github.com"},{"url":"https://www.drupal.org/sa-core-2022-002","label":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"security-advisories@github.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"security-advisories@github.com"},{"url":"https://www.tenable.com/security/tns-2022-09","label":"security-advisories@github.com"},{"url":"https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.jqueryui.com/ticket/15284","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/jquery/jquery-ui/pull/1953","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20211118-0004/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.drupal.org/sa-contrib-2022-004","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.drupal.org/sa-core-2022-001","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.drupal.org/sa-core-2022-002","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2022-09","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.08533,"epssPercentile":0.94871,"ingestedAt":"2026-08-25T17:29:31.704Z","slug":"CVE-2021-41183","body":"## Overview\n\njQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.\n\n## Affected\n\n- `jquery_ui < 1.13.0`\n- `fedora = 33`\n- `fedora = 34`\n- `fedora = 35`\n- `fedora = 36`\n- `h300s_firmware`\n- `h500s_firmware`\n- `h700s_firmware`\n- `h300e_firmware`\n- `h500e_firmware`\n- `h700e_firmware`\n- `h410s_firmware`\n- `h410c_firmware`\n- `debian_linux = 9.0`\n- `drupal >= 7.0, < 7.86`\n- `drupal >= 9.2.0, < 9.2.11`\n- `drupal >= 9.3.0, < 9.3.3`\n- `agile_product_lifecycle_management = 9.3.6`\n- `application_express < 22.1.1`\n- `banking_platform = 2.9.0`\n- `banking_platform = 2.12.0`\n- `big_data_spatial_and_graph < 23.1`\n- `big_data_spatial_and_graph = 23.1`\n- `communications_interactive_session_recorder = 6.4`\n- `communications_operations_monitor = 4.3`\n- `communications_operations_monitor = 4.4`\n- `communications_operations_monitor = 5.0`\n- `hospitality_inventory_management = 9.1.0`\n- `hospitality_suite8 >= 8.11.0, <= 11.14.0`\n- `hospitality_suite8 = 8.10.2`\n- `jd_edwards_enterpriseone_tools <= 9.2.6.3`\n- `mysql_enterprise_monitor <= 8.0.29`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `peoplesoft_enterprise_peopletools = 8.59`\n- `policy_automation >= 12.2.0, <= 12.2.5`\n- `primavera_gateway >= 17.7, <= 17.12`\n- `primavera_gateway = 18.8.0`\n- `primavera_gateway = 19.12.0`\n- `primavera_gateway = 20.12.0`\n- `primavera_gateway = 21.12.0`\n- `rest_data_services < 22.1.1`\n- `rest_data_services = 22.1.1`\n- `weblogic_server = 12.2.1.3.0`\n- `weblogic_server = 12.2.1.4.0`\n- `weblogic_server = 14.1.1.0.0`\n- `tenable.sc < 5.21.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `jquery_ui 1.13.0`\n- `drupal 9.3.3`\n- `application_express 22.1.1`\n- `big_data_spatial_and_graph 23.1`\n- `rest_data_services 22.1.1`\n- `tenable.sc 5.21.0`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":35.8,"likelihood":1.7,"exploitation":0,"ransomware":0},"changes":[]}