Description
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jquery | jquery-ui | < 1.13.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jqueryui | 1.13.2+dfsg-1 | — |
| Debian 13 | jqueryui | 1.13.2+dfsg-1 | — |
| Debian 12 | jqueryui | 1.13.2+dfsg-1 | — |
| Debian 10 | jqueryui | 1.12.1+dfsg-5+deb10u1 | DLA-3230-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.20.04.1 | USN-6419-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | jqueryui | 1.13.1+dfsg-1ubuntu0.1~esm1 | USN-5181-1 |
| Ubuntu Pro 20.04 LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | USN-5181-1 |
| Ubuntu Pro 18.04 LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | USN-6419-1, USN-5181-1 |
| Ubuntu Pro 16.04 LTS | jqueryui | 1.10.1+dfsg-1ubuntu0.16.04.1~esm1 | USN-6419-1 |
| Ubuntu Pro 14.04 LTS | jqueryui | 1.10.1+dfsg-1ubuntu0.14.04.1~esm1 | USN-6419-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
CyberOne-TeamARES/jquery-cve-2022-31160 ★ 0 · Aug 12, 2025
jquery XSS Proof of Concept (PoC)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars.npm:jquery-ui | < 1.13.2 | 1.13.2 | GHSA-h6gj-6jjq-h8g9 |
| npm | jquery-ui | < 1.13.2 | 1.13.2 | GHSA-h6gj-6jjq-h8g9 |
| NuGet | jQuery.UI.Combined | < 1.13.2 | 1.13.2 | GHSA-h6gj-6jjq-h8g9 |
| RubyGems | jquery-ui-rails | < 8.0.0 | 8.0.0 | GHSA-h6gj-6jjq-h8g9 |
Advisories 19
- WID-SEC-2023-1033 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 5, 2026
- USN-6419-1 jqueryui vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-5181-1 jqueryui vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3230-1 jqueryui - security update Debian Security (DSA / DLA) · Mar 9, 2026
- NCSC-2024-0416 Kwetsbaarheden verholpen in Oracle Financial Services Applications NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3192 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- NCSC-2024-0302 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1657 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-0892 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0873 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2022-0708 jQuery: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Feb 26, 2024
- WID-SEC-2024-0107 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0124 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
- WID-SEC-2023-2678 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2102 Moodle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 20, 2023
- WID-SEC-2023-1784 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2022-2368 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 9, 2023
References
- https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9
- https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9
- https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/
- https://www.drupal.org/sa-contrib-2022-052
- https://security.netapp.com/advisory/ntap-20220909-0007/
- FEDORA-2022-22d8ba36d0 vendor-advisory
- FEDORA-2022-1a01ed37e2 vendor-advisory
- FEDORA-2022-7291b78111 vendor-advisory
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3230-1] jqueryui security update mailing-list