CVE-2021-41182: XSS in the `altField` option of the Datepicker widget
Vulnerability summary
CVE-2021-41182 is a medium (CVSS 6.5) vulnerability in debian debian_linux. EPSS estimates a 39.36% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 26-10-2021PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
CVSS metrics
10 scores · 9 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · NpmEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · NugetEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · RubygemsEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
39.36%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 39.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundJquery Ui
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle16 products
- agile_product_lifecycle_management9.3.6
- application_express< 22.1.1
- banking_platform2.9.0 | 2.12.0
- big_data_spatial_and_graph< 23.1 | 23.1
- communications_interactive_session_recorder6.4
Debian2 products
- jqueryui< 1.13.0+dfsg-1
- debian_linuxEOL9.0
Alpine1 product
- drupal7< 7.86-r0
Drupal1 product
- drupal≥ 7.0, < 7.86
Fedoraproject1 product
- fedoraEOL33 | 34 | 35 | 36
Jquery1 product
- jquery-ui< 1.13.0
Jqueryui1 product
- jquery_ui< 1.13.0
Npm1 product
- jquery-ui< 1.13.0
NuGet1 product
- jQuery.UI.Combined< 1.13.0
Org.webjars.npm1 product
- jquery-ui< 1.13.0
RubyGems1 product
- jquery-ui-rails< 7.0.0
Tenable1 product
- tenable.sc< 5.21.0
Ubuntu1 product
- jqueryui< 1.10.1+dfsg-1ubuntu0.14.04.1~esm1 | < 1.10.1+dfsg-1ubuntu0.16.04.1~esm1 | < 1.12.1+dfsg-5ubuntu0.18.04.1~esm3 | < 1.12.1+dfsg-5ubuntu0.20.04.1
14 vendors · 37 products
References
37 links- github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwcREPORTWEBExploitMitigationThird Party Advisory
- github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63REPORTWEBPatchThird Party Advisory
- security.netapp.com/advisory/ntap-20211118-0004/Third Party Advisory
Show all 37 references
- github.com/jquery/jquery-uiPACKAGE