jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
CVE-2021-41184
CVSS base score
6.5 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-79
Last modified
November 2, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
jqueryui jquery ui
fedoraproject fedora
netapp h300s firmware
netapp h500s firmware
netapp h700s firmware
netapp h300e firmware
netapp h500e firmware
netapp h700e firmware
netapp h410s firmware
netapp h410c firmware
References
- blog.jqueryui.com Release Notes, Vendor Advisory
- github.com Patch, Vendor Advisory
- github.com Mitigation, Patch, Vendor Advisory
- lists.debian.org
- lists.fedoraproject.org Mailing List, Third Party Advisory
- lists.fedoraproject.org Mailing List, Third Party Advisory
- lists.fedoraproject.org Mailing List, Third Party Advisory
- lists.fedoraproject.org Mailing List, Third Party Advisory
- lists.fedoraproject.org Mailing List, Third Party Advisory
- security.netapp.com Third Party Advisory