Cross-Site Scripting (XSS) in jquery-ui (CVE-2021-41183, CVSS 6.5)

Summary

Cross-site scripting in jquery-ui (CVE-2021-41183). Data can be tampered with by attackers. Exploitable via doEvilThing. Mitigation: upgrade to 1.13.0 or later.

Original description

The description as published by the source.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources.

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-41183 has been found in jquery-ui.
Attackers can target a specific entry point like doEvilThing over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 6.5/10.
What to do: upgrade jquery-ui to 1.13.0 or later.
If unsure, ask your IT team or search "jquery-ui CVE-2021-41183" on the vendor's site.

CVE-2021-41183 (jquery-ui) — CWE-79 / CVSS v3 6.5
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: doEvilThing
Patched: 1.13.0 — apply immediately
Workaround: A workaround is to not accept the value of the *Text options from untrusted sources.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Cross-site scripting (XSS) (CWE-79) exists in jquery-ui. Attackers reach the vulnerable code path via doEvilThing without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of jquery-ui. Attack surface: doEvilThing.

🔥 Severity

Severity: Medium (CVSS 6.5/10). Data can be tampered with by attackers.

🔧 How to fix

Update to 1.13.0.

🛡️ Workaround

Workaround: A workaround is to not accept the value of the *Text options from untrusted sources.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'jquery-ui' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'jquery-ui' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で jquery-ui を grep し、稼働しているサービス・バージョンを把握する。
2
Apply temporary workaround mitigate
```
A workaround is to not accept the value of the `*Text` options from untrusted sources.
```
パッチが適用されるまでの応急処置として、A workaround is to not accept the value of the *Text options from untrusted sources. を実施。回避策の副作用 (機能低下) を確認した上で。
3
Apply patch patch
```
Upgrade jquery-ui to 1.13.0
```
ステージング環境で 1.13.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
4
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm jquery-ui

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]

Maven org.webjars.npm:jquery-ui

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]

RubyGems jquery-ui-rails

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0"}]}]

NuGet jQuery.UI.Combined

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]

Bitnami drupal

[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.86.0"},{"introduced":"9.2.0"},{"fixed":"9.2.11"},{"introduced":"9.3.0"},{"fixed":"9.3.3"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-41183 jqueryui Fixed in: 1.13.0+dfsg-1

Cross-Site Scripting (XSS) in jquery-ui (CVE-2021-41183)