CVE-2021-41184

Name of the Vulnerable Software and Affected Versions jQuery UI versions prior to 1.13.0

Description The issue is related to the .position() util in jQuery UI, where accepting the value of the of option from untrusted sources may execute untrusted code. Any string value passed to the of option is now treated as a CSS selector in version 1.13.0. A workaround is to not accept the value of the of option from untrusted sources. For example, invoking the following code:

$( "#element" ).position( {
  my: "left top",
  at: "right bottom",
  of: "<img onerror='doEvilThing()' src='/404' />",
  collision: "none"
} );

will call the doEvilThing() function.

Recommendations To resolve the issue, update to jQuery UI version 1.13.0 or later. As a temporary workaround, consider not accepting the value of the of option from untrusted sources. Restrict access to the .position() util to minimize the risk of exploitation. Avoid using the of option in the affected API endpoint until the issue is resolved.