CVE-2021-41184

Overview

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery that provides a comprehensive suite of UI components for modern web applications.

‍

A medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2021-41184) has been identified in jQuery UI. The .position() utility's handling of the of option could allow attackers to inject malicious scripts through HTML markup in user-controlled strings, leading to arbitrary code execution.

‍

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

‍

Details

Module Info

• Product: jQuery UI
• Affected packages: jquery-ui
• Affected versions: <1.13.0
• GitHub repository: https://github.com/jquery/jquery-ui
• Published packages: https://www.npmjs.com/package/jquery-ui
• Package manager: npm
• Fixed in:
  
  • OSS v1.13.0
  • NES for jQuery UI v1.8.26

‍

Vulnerability Info

This medium-severity vulnerability is found in jQuery UI versions prior to 1.13.0. See the affected versions above for specific details.

‍

The vulnerability affected the .position() utility:

‍

• $.fn.position() in ui/jquery.ui.position.js accepted string values for the of option without validation, passing them directly to jQuery's $() constructor which interprets HTML markup as DOM elements rather than CSS selectors.
• When user-controlled strings containing HTML tags (e.g., <img> with onerror handlers) were passed to the of option, the browser would parse and execute embedded JavaScript.
• Applications using .position() with untrusted input in the of parameter were vulnerable to script injection.

‍

This vulnerability could be exploited by:

‍

• providing crafted HTML strings to the of option containing special characters and tags (<, >, ", ')
• injecting script tags or event handlers (e.g., onerror, onload) through malicious HTML markup
• leveraging applications that pass user-controlled data to .position() without sanitization

‍

Mitigation

jQuery UI version 1.8.x is End-of-Life and will not receive any updates to address this issue from the jQuery team.

‍

Users of the affected .position() utility should apply one of the following mitigations:

‍

• Upgrade affected applications to jQuery UI 1.13.0 or later.
• Validate and sanitize any values from untrusted sources before passing them to .position().
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍