CVE-2016-7103

What it actually does

Allows remote injection of arbitrary web script or HTML via the closeText parameter in the jQuery UI dialog function, enabling execution of attacker-controlled code in the context of the affected web page.

Why it matters to the business

Web applications relying on vulnerable jQuery UI versions face risk of client-side code execution that can expose user sessions, steal data, or perform unauthorized actions; widespread use of the library amplifies exposure across many deployments, and the presence of public exploits increases urgency for remediation.

How an attack unfolds

An attacker identifies a web page using the vulnerable jQuery UI dialog with closeText derived from unsanitized input, crafts a malicious payload containing script tags or event handlers, and delivers it to a victim; when the dialog renders, the payload executes in the victim's browser, allowing actions such as cookie theft or redirection.

How to fix it

Upgrade jQuery UI to version 1.12.0 or later; for listed products apply harbor-fips-2.11 (Chainguard) 2.11.0-r3 or newer and jquery/jquery-ui commit 9644e7bae9116edaf8d37c5b38cb32b892f10ff6 or equivalent.

How to confirm the fix worked

Confirm jquery-ui version is 1.12.0 or higher via package manifests or script tags; test dialog closeText with benign payloads to verify sanitization; scan for remaining instances of pre-1.12.0 jquery-ui files.

Typical attack path

1. Identify web application using jQuery UI < 1.12.0 dialog function
2. Determine if closeText parameter accepts or reflects unsanitized input
3. Craft and deliver XSS payload via closeText (e.g., through URL, form, or stored data)
4. Victim interaction triggers dialog rendering and payload execution
5. Attacker receives session data or performs actions in victim context

How to detect it

Review web server and application logs for unusual dialog closeText values containing script tags or event handlers; inspect client-side requests and rendered pages for reflected or stored payloads; check browser console or network captures for unexpected script execution originating from jquery-ui dialog rendering.

What your security team should do

• Immediately update all instances of jQuery UI to the fixed versions provided
• Audit web applications for use of dialog closeText with untrusted data and implement input sanitization
• Monitor exploit availability and prioritize patching given public exploit maturity
• Review downstream dependencies in affected products such as Harbor components