jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label
Priority MEDIUM 60CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0269 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jquery-ui (jquery): 1.13.2jquery-ui (npm): 1.13.2+3 more productsRed Hat: 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JQuery | jquery-ui | before 1.13.2 | 1.13.2 | Patch available | CNA |
| — | jquery-ui (npm) | before 1.13.2 | 1.13.2 | Patch available | GHSA-h6gj-6jjq-h8g9 |
| — | org.webjars.npm:jquery-ui (Maven) | before 1.13.2 | 1.13.2 | Patch available | GHSA-h6gj-6jjq-h8g9 |
| — | jquery-ui-rails (RubyGems) | before 8.0.0 | 8.0.0 | Patch available | GHSA-h6gj-6jjq-h8g9 |
| — | jQuery.UI.Combined (NuGet) | before 1.13.2 | 1.13.2 | Patch available | GHSA-h6gj-6jjq-h8g9 |
- jquery-ui VendorJQuery Affected before 1.13.2 Fixed in 1.13.2 Patch available CNA
- jquery-ui (npm) Vendor— Affected before 1.13.2 Fixed in 1.13.2 Patch available GHSA-h6gj-6jjq-h8g9
- org.webjars.npm:jquery-ui (Maven) Vendor— Affected before 1.13.2 Fixed in 1.13.2 Patch available GHSA-h6gj-6jjq-h8g9
- jquery-ui-rails (RubyGems) Vendor— Affected before 8.0.0 Fixed in 8.0.0 Patch available GHSA-h6gj-6jjq-h8g9
- jQuery.UI.Combined (NuGet) Vendor— Affected before 1.13.2 Fixed in 1.13.2 Patch available GHSA-h6gj-6jjq-h8g9
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:* | before 1.13.2 | Vulnerable | Jqueryui |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:jqueryui:jquery_ui:*:*:*:*:*:jquery:*:* Versions before 1.13.2 Vulnerable ·Jqueryui
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.0:*:*:*:*:drupal:*:* | 8.x-1.0 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.1:*:*:*:*:drupal:*:* | 8.x-1.1 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.2:*:*:*:*:drupal:*:* | 8.x-1.2 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.3:*:*:*:*:drupal:*:* | 8.x-1.3 | Vulnerable | Drupal |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.0:*:*:*:*:drupal:*:* Versions 8.x-1.0 Vulnerable ·Drupal
- cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.1:*:*:*:*:drupal:*:* Versions 8.x-1.1 Vulnerable ·Drupal
- cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.2:*:*:*:*:drupal:*:* Versions 8.x-1.2 Vulnerable ·Drupal
- cpe:2.3:a:drupal:jquery_ui_checkboxradio:8.x-1.3:*:*:*:*:drupal:*:* Versions 8.x-1.3 Vulnerable ·Drupal
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · CNA jquery-ui (jquery) Fixed in 1.13.2
- Fix · GHSA-h6gj-6jjq-h8g9 jquery-ui (npm) Fixed in 1.13.2 Advisory →
- Fix · GHSA-h6gj-6jjq-h8g9 org.webjars.npm:jquery-ui (Maven) Fixed in 1.13.2 Advisory →
- Fix · GHSA-h6gj-6jjq-h8g9 jquery-ui-rails (RubyGems) Fixed in 8.0.0 Advisory →
- Fix · GHSA-h6gj-6jjq-h8g9 jQuery.UI.Combined (NuGet) Fixed in 1.13.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31160
- 2026-10-03 Alias added: GHSA-h6gj-6jjq-h8g9
References
Advisory 8
- https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/
- https://www.drupal.org/sa-contrib-2022-052
- https://security.netapp.com/advisory/ntap-20220909-0007/
- FEDORA-2022-22d8ba36d0
- FEDORA-2022-1a01ed37e2
- FEDORA-2022-7291b78111
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3230-1] jqueryui security update
- https://nvd.nist.gov/vuln/detail/CVE-2022-31160
Other 9
- https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released
- https://github.com/jquery-ui-rails/jquery-ui-rails/blob/master/VERSIONS.md
- https://github.com/jquery-ui-rails/jquery-ui-rails/releases/tag/v8.0.0-release
- https://github.com/jquery/jquery-ui
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2022-31160.yml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD
- https://lists.fedoraproject.org/archives/list/[email protected]/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6
- https://security.netapp.com/advisory/ntap-20220909-0007
More JQuery vulnerabilities
- TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
- TI-2020-08896 jQuery has a potential XSS vulnerability CVSS 3.1MEDIUM 6.9
- TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
- TI-2021-18023 XSS in the `of` option of the `.position()` util CVSS 3.1MEDIUM 6.5
- TI-2021-18021 XSS in the `altField` option of the Datepicker widget CVSS 3.1MEDIUM 6.5
- TI-2015-07630 jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2022-31160 · CVE Program
- CVE-2022-31160 · NVD
- FIRST EPSS
- GHSA-h6gj-6jjq-h8g9 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-31160 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences