CVE-2021-41184: Drupal

Medium severity, CVSS 6.1. EPSS: 40.8% chance of exploitation in the next 30 days.

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

Affected products

  • Drupal Drupal: from 7.0, before 7.86 (fixed in 7.86); from 9.2.0, before 9.2.11 (fixed in 9.2.11); from 9.3.0, before 9.3.3 (fixed in 9.3.3)
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only; version 36 only
  • Jqueryui jQuery UI: before 1.13.0 (fixed in 1.13.0)
  • Netapp h300e Firmware: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410c Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500e Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700e Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Application Express: before 22.1.1 (fixed in 22.1.1)
  • Oracle Banking Platform: version 2.9.0 only; version 2.12.0 only
  • Oracle Big Data Spatial And Graph: before 23.1 (fixed in 23.1); version 23.1 only
  • Oracle Communications Interactive Session Recorder: version 6.4 only
  • Oracle Communications Operations Monitor: version 4.3 only; version 4.4 only; version 5.0 only
  • Oracle Hospitality Inventory Management: version 9.1.0 only
  • Oracle Hospitality Materials Control: version 18.1 only
  • Oracle Hospitality SUITE8: from 8.11.0, up to and including 8.14.0; version 8.10.2 only
  • Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.6.3
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
  • Oracle Policy Automation: from 12.2.0, up to and including 12.2.25
  • Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only; version 21.12 only
  • Oracle Rest Data Services: before 22.1.1 (fixed in 22.1.1); version 22.1.1 only
  • and 2 more

Published 2021-10-26. Last modified 2026-08-25.