CVE-2021-41182

What it actually does

Cross-site scripting flaw in jQuery UI allows arbitrary JavaScript execution through unsanitized title option values passed to dialog widgets.

Why it matters to the business

Attackers can steal session tokens, perform actions on behalf of users, or deface web interfaces in any application using the affected library versions, increasing breach risk and support costs across many sites.

How an attack unfolds

An attacker identifies a page using a vulnerable jQuery UI version, supplies a malicious title containing script tags or event handlers to a dialog constructor, and induces a user action that opens the dialog so the payload executes in the victim's browser context.

How to fix it

Upgrade jquery/jquery-ui to commit 6d072c596a81d99a77fc36c14caf3eb3a803689e, drupal/drupal to commit c991d5749144c851b71aa7be721715d7e346526f, and wordpress (Debian 4.0) to 2.0.10-1etch1 or later; remove or replace any remaining vulnerable copies of jquery-ui.js.

How to confirm the fix worked

Verify the deployed jquery-ui source or minified file matches a fixed commit hash, run dependency scanners against package manifests, and confirm dialog initialization no longer renders raw HTML from the title option.

Typical attack path

1. Scan target application to confirm presence and version of jquery-ui
2. Craft payload that injects executable script via the dialog title option
3. Deliver payload through user-controlled input or URL parameters
4. Trigger dialog rendering in the victim's browser session
5. Execute malicious script to exfiltrate data or perform unauthorized actions

How to detect it

Search web server and application logs for requests containing script tags or event handlers in parameters that feed dialog title options; inspect browser console errors or network requests triggered by dialog open events for unexpected script execution.

• jquery-ui.js containing unpatched dialog title handling before commit 6d072c596a81d99a77fc36c14caf3eb3a803689e
• dialog title values containing <script> or on* event handlers in access logs

What your security team should do

• Prioritize upgrade of all jquery-ui instances within 48 hours given exploit availability and EPSS score of 0.39
• Scan codebases and CDN references for the vulnerable library versions listed
• Implement content security policy headers to limit script execution from unexpected sources
• Review and sanitize all inputs passed to jQuery UI dialog options
• Monitor vulnerability feeds for any new threat actor campaigns targeting this family