Skip to content
Fencer Vulns
medium 6.5

CVE-2021-41184 json

XSS in the `of` option of the `.position()` util

published 2021-10-26 5 y ago modified 2026-11-02 6 d ago also BIT-drupal-2021-41184 , EUVD-2021-2204 , GHSA-gpqq-952q-5327

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
40.8%
EPSS 40.8% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Patch / fix

  • npm jquery-ui 1.13.0
  • maven org.webjars.npm:jquery-ui 1.13.0
  • nuget jQuery.UI.Combined 1.13.0
  • rubygems jquery-ui-rails 7.0.0
  • bitnami drupal 7.86.0, 9.2.11, 9.3.3
  • jqueryui jquery_ui 1.13.0
  • drupal drupal 7.86, 9.2.11, 9.3.3
  • tenable tenable.sc 5.21.0
  • oracle application_express 22.1.1
  • oracle big_data_spatial_and_graph 23.1
  • oracle rest_data_services 22.1.1
  • jqueryui Debian 14, Debian 13, Debian 12 1.13.0+dfsg-1

debian advisories DEBIAN-CVE-2021-41184

  • jqueryui Ubuntu 20.04 LTS 1.12.1+dfsg-5ubuntu0.20.04.1
  • jqueryui Ubuntu Pro 18.04 LTS 1.12.1+dfsg-5ubuntu0.18.04.1~esm2
  • jqueryui Ubuntu Pro 20.04 LTS 1.12.1+dfsg-5ubuntu0.20.04.1~esm3

ubuntu advisories UBUNTU-CVE-2021-41184

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rhvm rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-web-ui rhev manager 4.4 1.8.1-2.el8ev
  • ovirt-engine-setup rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-tools rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-backend rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-restapi rhev manager 4.4 4.5.0.7-0.9.el8ev
  • ovirt-engine-dbscripts rhev manager 4.4 4.5.0.7-0.9.el8ev

red hat advisories RHSA-2022:4711

  • grafana OpenStack Cloud Crowbar 9, OpenStack Cloud 9 6.7.4-3.26.1
  • python-lxml OpenStack Cloud Crowbar 9, OpenStack Cloud 9 4.2.4-3.3.1
  • python-Pillow OpenStack Cloud Crowbar 9, OpenStack Cloud 9 5.2.0-3.17.1
  • ardana-barbican OpenStack Cloud 9 9.0+git.1644879908.8a641c1-3.13.1
  • rubygem-sinatra OpenStack Cloud Crowbar 9 1.4.6-4.3.1
  • openstack-cinder OpenStack Cloud Crowbar 9, OpenStack Cloud 9 13.0.10~dev24-3.34.2
  • openstack-ironic OpenStack Cloud Crowbar 9, OpenStack Cloud 9 11.1.5~dev18-3.28.2
  • openstack-neutron OpenStack Cloud Crowbar 9, OpenStack Cloud 9 13.0.8~dev206-3.40.1

suse advisories SUSE-SU-2022:1729-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41184 updated cvss 6.5

jquery-ui: XSS in the 'of' option of the .position() util

  • Red Hat Decision Manager 7 jquery-ui jquery-ui Red Hat Process Automation 7 jquery-ui jquery-ui
    affected: no fix planned “Out of support scope”
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.5.0.7-0.9.el8ev, ovirt-engine 4.5.0.7-0.9.el8ev, ovirt-engine-setup 4.5.0.7-0.9.el8ev, ovirt-engine-tools 4.5.0.7-0.9.el8ev, ovirt-engine-backend 4.5.0.7-0.9.el8ev, ovirt-engine-restapi 4.5.0.7-0.9.el8ev, +14 more
    fixed: vendor fix RHSA-2022:4711
  • Red Hat Ansible Tower 3 jquery-ui Red Hat Enterprise Linux 6 pcs Red Hat Enterprise Linux 7 pcs, pcs-snmp, python-clufter Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-web-ui 1.8.1-2.el8ev, apache-sshd 2.8.0-0.1.el8ev, ansible-runner 2.1.3-1.el8ev, engine-db-query 1.6.4-1.el8ev, ovirt-engine-dwh 4.5.2-1.el8ev, vdsm-jsonrpc-java 1.7.1-2.el8ev, +13 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 d ago

Exploit prediction

40.77% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
OSV 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm jquery-ui
<1.13.0
1.13.0
maven org.webjars.npm:jquery-ui
<1.13.0
1.13.0
nuget jQuery.UI.Combined
<1.13.0
1.13.0
rubygems jquery-ui-rails
<7.0.0
7.0.0
bitnami drupal
>=7.0.0, <7.86.0
>=9.2.0, <9.2.11
>=9.3.0, <9.3.3
7.86.0
9.2.11
9.3.3

Affected products

  • jquery jquery-ui

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.