Description
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jquery | jquery-ui | < 1.13.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jqueryui | 1.13.0+dfsg-1 | — |
| Debian 13 | jqueryui | 1.13.0+dfsg-1 | — |
| Debian 12 | jqueryui | 1.13.0+dfsg-1 | — |
| Debian 10 | jqueryui | 1.12.1+dfsg-5+deb10u1 | DLA-3230-1 |
| Debian 10 | otrs2 | 6.0.16-2+deb10u1 | DLA-3551-1 |
| Debian 9 | drupal7 | 7.52-2+deb9u17 | DLA-2889-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.20.04.1 | USN-6419-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.18.04.1~esm3 | USN-6419-1 |
| Ubuntu Pro 16.04 LTS | jqueryui | 1.10.1+dfsg-1ubuntu0.16.04.1~esm1 | USN-6419-1 |
| Ubuntu Pro 14.04 LTS | jqueryui | 1.10.1+dfsg-1ubuntu0.14.04.1~esm1 | USN-6419-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.3.3-1.el8ev | RHSA-2022:4711 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.8.1-2.el8ev | RHSA-2022:4711 |
| Red Hat Rhev Manager 4 | rhvm +19 | 4.5.0.7-0.9.el8ev | RHSA-2022:4711 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | grafana | 6.7.4-3.26.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev24-3.14.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-cinder | 13.0.10~dev24-3.34.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-ironic | 11.1.5~dev18-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-keystone | 14.2.1~dev9-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev206-3.40.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Pillow | 5.2.0-3.17.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-lxml | 4.2.4-3.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-sinatra | 1.4.6-4.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | ardana-barbican | 9.0+git.1644879908.8a641c1-3.13.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | grafana | 6.7.4-3.26.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev24-3.14.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-cinder | 13.0.10~dev24-3.34.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-ironic | 11.1.5~dev18-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-keystone | 14.2.1~dev9-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev206-3.40.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | python-Pillow | 5.2.0-3.17.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | python-lxml | 4.2.4-3.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.35.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev24-3.38.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.33.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.39.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev18-4.33.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.36.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.41.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.37.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev206-6.39.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev91-3.39.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.30.1 | SUSE-SU-2022:1729-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.20 | drupal7 | 7.86-r0 | — |
| Alpine v3.19 | drupal7 | 7.86-r0 | — |
| Alpine v3.18 | drupal7 | 7.86-r0 | — |
| Alpine v3.17 | drupal7 | 7.86-r0 | — |
| Alpine v3.16 | drupal7 | 7.86-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | drupal7 | 7.86-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars.npm:jquery-ui | < 1.13.0 | 1.13.0 | GHSA-j7qv-pgf6-hvh4 |
| npm | jquery-ui | < 1.13.0 | 1.13.0 | GHSA-j7qv-pgf6-hvh4 |
| NuGet | jQuery.UI.Combined | < 1.13.0 | 1.13.0 | GHSA-j7qv-pgf6-hvh4 |
| RubyGems | jquery-ui-rails | < 7.0.0 | 7.0.0 | GHSA-j7qv-pgf6-hvh4 |
Advisories 13
- RHSA-2022:4711 Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- USN-6419-1 jqueryui vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-3551-1 otrs2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2889-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3230-1 jqueryui - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:1729-1 Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2022-1729 jQuery: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Oct 5, 2023
- WID-SEC-2023-2309 SAP Patchday September 2023 BSI CERT-Bund (WID) · Sep 11, 2023
- WID-SEC-2023-2102 Moodle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 20, 2023
- WID-SEC-2023-1022 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2022-2368 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 9, 2023
- VDE-2022-019 Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components CERT@VDE · Jun 2, 2022
References
- https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
- https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4
- https://github.com/jquery/jquery-ui/pull/1953
- https://bugs.jqueryui.com/ticket/15284
- FEDORA-2021-51c256bf87 vendor-advisory
- FEDORA-2021-ab38307fc3 vendor-advisory
- FEDORA-2021-013ab302be vendor-advisory
- [debian-lts-announce] 20220119 [SECURITY] [DLA-2889-1] drupal7 security update mailing-list
- https://www.drupal.org/sa-core-2022-002
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20211118-0004/
- https://www.drupal.org/sa-contrib-2022-004
- https://www.drupal.org/sa-core-2022-001
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.tenable.com/security/tns-2022-09
- FEDORA-2022-9d655503ea vendor-advisory
- FEDORA-2022-bf18450366 vendor-advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html