CVE-2021-41182: Debian Linux

Medium severity, CVSS 6.1. EPSS: 39.4% chance of exploitation in the next 30 days.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

Affected products

  • Debian Debian Linux: version 9.0 only
  • Drupal Drupal: from 7.0, before 7.86 (fixed in 7.86)
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only; version 36 only
  • Jqueryui jQuery UI: before 1.13.0 (fixed in 1.13.0)
  • Netapp h300e Firmware: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410c Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500e Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700e Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Application Express: before 22.1.1 (fixed in 22.1.1)
  • Oracle Banking Platform: version 2.9.0 only; version 2.12.0 only
  • Oracle Big Data Spatial And Graph: before 23.1 (fixed in 23.1); version 23.1 only
  • Oracle Communications Interactive Session Recorder: version 6.4 only
  • Oracle Communications Operations Monitor: version 4.3 only; version 4.4 only; version 5.0 only
  • Oracle Hospitality Inventory Management: version 9.1.0 only
  • Oracle Hospitality Materials Control: version 18.1 only
  • Oracle Hospitality SUITE8: from 8.11.0, up to and including 8.14.0; version 8.10.2 only
  • Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.6.3
  • Oracle MySQL Enterprise Monitor: up to and including 8.0.29
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
  • Oracle Policy Automation: from 12.2.0, up to and including 12.2.25
  • and 4 more

Published 2021-10-26. Last modified 2026-08-25.