jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade drupal7 | Aug 22, 2024 | Oct 26, 2021 |
| Debian | — | Upgrade jqueryui | Jan 21, 2022 | Oct 26, 2021 |
| Drupal | — | Upgrade to drupal version 7.86 | Mar 23, 2022 | Oct 26, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Oct 26, 2021 |
| Ubuntu | — | Upgrade libjs-jquery-ui (Ubuntu Pro)Upgrade libjs-jquery-uiUpgrade node-jquery-uiUpgrade node-jquery-ui (Ubuntu Pro) | Oct 6, 2023 | Oct 26, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub