CVE-2022-31160: Debian Linux

Medium severity, CVSS 6.1. EPSS: 2.7% chance of exploitation in the next 30 days.

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

Affected products

• Debian Debian Linux: version 10.0 only
• Drupal jQuery UI Checkboxradio: version 8.x-1.0 only; version 8.x-1.1 only; version 8.x-1.2 only; version 8.x-1.3 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Jqueryui jQuery UI: before 1.13.2 (fixed in 1.13.2)
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Oncommand Insight: affected versions not specified

Published 2022-07-20. Last modified 2026-06-17.