Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2021-41184

medium

jQuery-UI is the official jQuery user interface library.

Vendor / product: Jqueryui — jquery ui

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

CVSS
6.1
6.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2021-10-26 15:15
Modified: 2026-11-02 19:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

jqueryui / jquery_ui <1.13.0
fedoraproject / fedora 33, 34, 35, 36
netapp / h300s_firmware all versions
netapp / h500s_firmware all versions
netapp / h700s_firmware all versions
netapp / h300e_firmware all versions
netapp / h500e_firmware all versions
netapp / h700e_firmware all versions
netapp / h410s_firmware all versions
netapp / h410c_firmware all versions
drupal / drupal ≥7.0 <7.86, ≥9.2.0 <9.2.11, ≥9.3.0 <9.3.3
tenable / tenable.sc <5.21.0
oracle / agile_product_lifecycle_management 9.3.6
oracle / application_express <22.1.1
oracle / banking_platform 2.9.0, 2.12.0
oracle / big_data_spatial_and_graph <23.1, 23.1
oracle / communications_interactive_session_recorder 6.4
oracle / communications_operations_monitor 4.3, 4.4, 5.0
oracle / hospitality_inventory_management 9.1.0
oracle / hospitality_materials_control 18.1
oracle / hospitality_suite8 ≥8.11.0 ≤8.14.0, 8.10.2
oracle / jd_edwards_enterpriseone_tools ≤9.2.6.3
oracle / peoplesoft_enterprise_peopletools 8.58, 8.59
oracle / policy_automation ≥12.2.0 ≤12.2.25
oracle / primavera_unifier ≥17.7 ≤17.12, 18.8, 19.12, 20.12, 21.12
oracle / rest_data_services <22.1.1, 22.1.1
oracle / weblogic_server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

Weakness classification (CWE)

CWE-79

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
Vendor advisory: https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
Vendor advisory: https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
Vendor advisory: https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
Vendor advisory: https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
Vendor advisory: https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
Patch / mitigation: https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
Patch / mitigation: https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html
Patch / mitigation: https://www.tenable.com/security/tns-2022-09
Patch / mitigation: https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
Patch / mitigation: https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html
Patch / mitigation: https://www.tenable.com/security/tns-2022-09

References

Data sources

NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores