CVE-2021-41183

Name of the Vulnerable Software and Affected Versions jQuery UI versions prior to 1.13.0

Description Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker with options such as closeText, currentText, prevText, nextText, buttonText, or appendText set to untrusted input can lead to code execution. The issue is fixed in jQuery UI 1.13.0, where the values passed to these options are now treated as pure text, not HTML.

Recommendations For versions prior to 1.13.0, a workaround is to not accept the value of the *Text options from untrusted sources. Update to jQuery UI 1.13.0 or later to fix the issue.