DRUPAL-CONTRIB-2022-052

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/jquery_ui_checkboxradio/DRUPAL-CONTRIB-2022-052.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2022-052

Published

2022-08-10T15:09:36Z

Modified

2025-12-10T23:30:16.282917Z

Summary

[none]

Details

jQuery UI is a third-party library used by Drupal. The jQuery UI Checkboxradio module provides the jQuery UI Checkboxradio library (which was previously in Drupal 8 core, but has since been removed from core and moved to this module).

As part of the jQuery UI 1.13.2 update, the jQuery UI project disclosed following security issue that may affect sites using the jQuery UI Checkboxradio module:

CVE-2022-31160: XSS when refreshing a checkboxradio with an HTML-like initial text label

References

https://www.drupal.org/sa-contrib-2022-052

Credits

- Benji Fisher
- - https://www.drupal.org/user/683300

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/jquery_ui_checkboxradio

Package

Name: drupal/jquery_ui_checkboxradio
Purl: pkg:composer/drupal/jquery_ui_checkboxradio

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

1.4.0

Database specific

{
    "constraint": "<1.4.0"
}

Database specific

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/jquery_ui_checkboxradio/DRUPAL-CONTRIB-2022-052.json"

affected_versions

"<1.4.0"