This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-41183 →
DEBIAN-CVE-2021-41183
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker wid...
Original description
The description as published by the source.
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
jqueryui
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]
Debian:13
jqueryui
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]
Debian:14
jqueryui
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]
References
- advisory security-tracker.debian.org