CVE-2021-41183: Debian Linux

Medium severity, CVSS 6.1. EPSS: 8.5% chance of exploitation in the next 30 days.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.

Affected products

  • Debian Debian Linux: version 9.0 only
  • Drupal Drupal: from 7.0, before 7.86 (fixed in 7.86); from 9.2.0, before 9.2.11 (fixed in 9.2.11); from 9.3.0, before 9.3.3 (fixed in 9.3.3)
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only; version 36 only
  • Jqueryui jQuery UI: before 1.13.0 (fixed in 1.13.0)
  • Netapp h300e Firmware: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410c Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500e Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700e Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Application Express: before 22.1.1 (fixed in 22.1.1)
  • Oracle Banking Platform: version 2.9.0 only; version 2.12.0 only
  • Oracle Big Data Spatial And Graph: before 23.1 (fixed in 23.1); version 23.1 only
  • Oracle Communications Interactive Session Recorder: version 6.4 only
  • Oracle Communications Operations Monitor: version 4.3 only; version 4.4 only; version 5.0 only
  • Oracle Hospitality Inventory Management: version 9.1.0 only
  • Oracle Hospitality SUITE8: from 8.11.0, up to and including 11.14.0; version 8.10.2 only
  • Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.6.3
  • Oracle MySQL Enterprise Monitor: up to and including 8.0.29
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
  • Oracle Policy Automation: from 12.2.0, up to and including 12.2.5
  • Oracle Primavera Gateway: from 17.7, up to and including 17.12; version 18.8.0 only; version 19.12.0 only; version 20.12.0 only; version 21.12.0 only
  • and 3 more

Published 2021-10-26. Last modified 2026-08-25.