CVE-2021-41184

MediumCVSS 6.1/10Last modified Aug 25, 2026

Description

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 26, 2021
Last modified: Aug 25, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411856.5Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints t CVE-2021-411867.5Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin i CVE-2021-411878.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilit CVE-2021-411885.4Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in CVE-2021-411897.2DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permis CVE-2021-41199.8bookstack is vulnerable to Improper Access Control CVE-2021-411905.0The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution CVE-2021-411917.5Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have s CVE-2021-411926.5Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying t CVE-2021-411939.8wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions p CVE-2021-411949.8FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When Jupyter CVE-2021-411955.5TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations result