Skip to content
Fencer Vulns
medium 6.5

CVE-2021-41182 json

XSS in the `altField` option of the Datepicker widget

published 2021-10-26 5 y ago modified 2026-09-08 2 mo ago also BIT-drupal-2021-41182 , EUVD-2021-2186 , GHSA-9gj3-hwp5-pmwc

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
39.4%
EPSS 39.4% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

Patch / fix

  • npm jquery-ui 1.13.0
  • nuget jQuery.UI.Combined 1.13.0
  • rubygems jquery-ui-rails 7.0.0
  • maven org.webjars.npm:jquery-ui 1.13.0
  • bitnami drupal 7.86.0
  • jqueryui jquery_ui 1.13.0
  • drupal drupal 7.86
  • tenable tenable.sc 5.21.0
  • oracle application_express 22.1.1
  • oracle big_data_spatial_and_graph 23.1
  • oracle rest_data_services 22.1.1
  • jqueryui Debian 14, Debian 13, Debian 12 1.13.0+dfsg-1

debian advisories DEBIAN-CVE-2021-41182

  • jqueryui Ubuntu 20.04 LTS 1.12.1+dfsg-5ubuntu0.20.04.1
  • jqueryui Ubuntu Pro 14.04 LTS 1.10.1+dfsg-1ubuntu0.14.04.1~esm1
  • jqueryui Ubuntu Pro 16.04 LTS 1.10.1+dfsg-1ubuntu0.16.04.1~esm1
  • jqueryui Ubuntu Pro 18.04 LTS 1.12.1+dfsg-5ubuntu0.18.04.1~esm3

ubuntu advisories UBUNTU-CVE-2021-41182

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rhvm rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-web-ui rhev manager 4.4 1.8.1-2.el8ev
  • ovirt-engine-setup rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-tools rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-backend rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-restapi rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-dbscripts rhev manager 4.4 4.5.0.7-0.9.el8ev

red hat advisories RHSA-2022:4711

  • grafana OpenStack Cloud Crowbar 9, OpenStack Cloud 9 6.7.4-3.26.1
  • python-lxml OpenStack Cloud Crowbar 9, OpenStack Cloud 9 4.2.4-3.3.1
  • python-Pillow OpenStack Cloud Crowbar 9, OpenStack Cloud 9 5.2.0-3.17.1
  • ardana-barbican OpenStack Cloud 9 9.0+git.1644879908.8a641c1-3.13.1
  • rubygem-sinatra OpenStack Cloud Crowbar 9 1.4.6-4.3.1
  • openstack-cinder OpenStack Cloud Crowbar 9, OpenStack Cloud 9 13.0.10~dev24-3.34.2
  • openstack-ironic OpenStack Cloud Crowbar 9, OpenStack Cloud 9 11.1.5~dev18-3.28.2
  • openstack-neutron OpenStack Cloud Crowbar 9, OpenStack Cloud 9 13.0.8~dev206-3.40.1

suse advisories SUSE-SU-2022:1729-1

  • drupal7 Alpine 3.20, Alpine 3.19, Alpine 3.18 +3 more 7.86-r0

alpine advisories ALPINE-CVE-2021-41182

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41182 updated cvss 6.5

jquery-ui: XSS in the altField option of the datepicker widget

  • Red Hat Decision Manager 7 jquery-ui jquery-ui Red Hat Process Automation 7 jquery-ui jquery-ui
    affected: no fix planned “Out of support scope”
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.5.0.7-0.9.el8ev, ovirt-engine 4.5.0.7-0.9.el8ev, ovirt-engine-setup 4.5.0.7-0.9.el8ev, ovirt-engine-tools 4.5.0.7-0.9.el8ev, ovirt-engine-backend 4.5.0.7-0.9.el8ev, ovirt-engine-restapi 4.5.0.7-0.9.el8ev, +14 more
    fixed: vendor fix RHSA-2022:4711
  • Red Hat Ansible Tower 3 jquery-ui Red Hat Enterprise Linux 6 pcs Red Hat Enterprise Linux 7 pcs, pcs-snmp, python-clufter Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-web-ui 1.8.1-2.el8ev, apache-sshd 2.8.0-0.1.el8ev, ansible-runner 2.1.3-1.el8ev, engine-db-query 1.6.4-1.el8ev, ovirt-engine-dwh 4.5.2-1.el8ev, vdsm-jsonrpc-java 1.7.1-2.el8ev, +13 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

39.36% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm jquery-ui
<1.13.0
1.13.0
nuget jQuery.UI.Combined
<1.13.0
1.13.0
rubygems jquery-ui-rails
<7.0.0
7.0.0
maven org.webjars.npm:jquery-ui
<1.13.0
1.13.0
bitnami drupal
>=7.0.0, <7.86.0
7.86.0

Affected products

  • jquery jquery-ui

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.