GHSA-gpqq-952q-5327

Source

https://github.com/advisories/GHSA-gpqq-952q-5327

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-gpqq-952q-5327/GHSA-gpqq-952q-5327.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gpqq-952q-5327

Aliases

Published

2021-10-26T14:55:12Z

Modified

2024-03-11T05:18:56.831482Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

XSS in the `of` option of the `.position()` util in jquery-ui

Details

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:

$( "#element" ).position( {
    my: "left top",
    at: "right bottom",
    of: "<img onerror='doEvilThing()' src='/404' />",
    collision: "none"
} );

will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Database specific

{
    "nvd_published_at": "2021-10-26T15:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-25T22:06:43Z"
}

References

Affected packages

npm / jquery-ui

Package

Name: jquery-ui; View open source insights on deps.dev
Purl: pkg:npm/jquery-ui

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.13.0

Maven / org.webjars.npm:jquery-ui

Package

Name: org.webjars.npm:jquery-ui; View open source insights on deps.dev
Purl: pkg:maven/org.webjars.npm/jquery-ui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.13.0

Affected versions

1.*

1.10.4

1.10.5

1.12.0-rc.2

1.12.0

1.12.1

1.13.0-rc.2

1.13.0-rc.3

NuGet / jQuery.UI.Combined

Package

Name: jQuery.UI.Combined; View open source insights on deps.dev
Purl: pkg:nuget/jQuery.UI.Combined

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.13.0

Affected versions

1.*

1.8.9

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.8.18

1.8.19

1.8.20

1.8.20.1

1.8.21

1.8.22

1.8.23

1.8.24

1.9.0-RC1

1.9.0

1.9.1

1.9.2

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4

1.12.0

1.12.1

RubyGems / jquery-ui-rails

Package

Name: jquery-ui-rails
Purl: pkg:gem/jquery-ui-rails

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.0.0

Affected versions

0.*

0.0.1

0.0.2

0.1.0

0.2.0

0.2.1

0.2.2

0.3.0

0.4.0

0.4.1

0.5.0

1.*

1.0.0

1.1.0

1.1.1

2.*

2.0.0

2.0.1

2.0.2

3.*

3.0.0

3.0.1

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.1.0

4.1.1

4.1.2

4.2.0

4.2.1

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

6.*

6.0.0

6.0.1