CVE-2016-7103
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
CVE-2016-7103 is a medium vulnerability (CVSS 6.1) in Jqueryui Jquery Ui, published March 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 29.2%, the 98th percentile. Fixed in jquery-ui 1.12.0.
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
- Record
CVE-2016-7103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
- Record
CVE-2016-7103- Updated
- 2026-11-02
EUVDEUVD-2017-0253 No score
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
- Record
EUVD-2017-0253- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hpcf-8vf9-q4gj
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.
jQuery-UI is a library for manipulating UI elements via jQuery.
Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.
Recommendation
Upgrade to jQuery-UI 1.12.0 or later.
- Record
GHSA-hpcf-8vf9-q4gj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
- Record
CVE-2016-7103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-7103
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
- Record
DEBIAN-CVE-2016-7103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 12 moreShow less
OSVGHSA-hpcf-8vf9-q4gj
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.
jQuery-UI is a library for manipulating UI elements via jQuery.
Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.
Recommendation
Upgrade to jQuery-UI 1.12.0 or later.
- Record
GHSA-hpcf-8vf9-q4gj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHSA-2016:2932
Red Hat Security Advisory: python-XStatic-jquery-ui security update
- Record
RHSA-2016:2932- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2016:2933
Red Hat Security Advisory: python-XStatic-jquery-ui security update
- Record
RHSA-2016:2933- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2017:0161
Red Hat Security Advisory: python-XStatic-jquery-ui security update
- Record
RHSA-2017:0161- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-7103
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
- Record
UBUNTU-CVE-2016-7103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773188127 No score
TuxCare security update for jquery-ui (5 CVEs)
TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.4-tuxcare.1.
- Record
CLSA-2026-1773188127- Updated
- 2026-11-02
OSVCLSA-2026-1792502475 No score
TuxCare security update for jquery-ui (5 CVEs)
TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.3-tuxcare.1.
- Record
CLSA-2026-1792502475- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11214-1 No score
python36-XStatic-jquery-ui-1.12.1.1-2.11 on GA media
These are all security issues fixed in the python36-XStatic-jquery-ui-1.12.1.1-2.11 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11214-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14131-1 No score
python310-XStatic-jquery-ui-1.13.0.1-1.15 on GA media
These are all security issues fixed in the python310-XStatic-jquery-ui-1.13.0.1-1.15 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14131-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11997-1 No score
python313-XStatic-jquery-ui-1.13.0.1-2.4 on GA media
These are all security issues fixed in the python313-XStatic-jquery-ui-1.13.0.1-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11997-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2351-1 No score
Security update for python-XStatic-jquery-ui
This update for python-XStatic-jquery-ui fixes the following issues:
- CVE-2016-7103: possible cross-site scripting in dialog closeText could lead to arbitrary code injection (bsc#996004)
- Record
SUSE-SU-2017:2351-1- Updated
- 2026-11-02
OSVUSN-6419-1 No score
jqueryui vulnerabilities
Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which could lead to arbitrary web script or HTML code injection. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)
Esben Sparre Andreasen discovered that jQuery UI did not properly handle values from untrusted sources in the Datepicker widget. A remote attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-41182, CVE-2021-41183)
It was discovered that jQuery UI did not properly validate values from untrusted sources. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-41184)
It was discovered that the jQuery UI checkboxradio widget did not properly decode certain values from HTML entities. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-31160)
- Record
USN-6419-1- Updated
- 2026-11-02
Affected products
- jqueryui jquery ui
- debian linux
- fedoraproject fedora
- juniper junos
- netapp snapcenter
- oracle application express
- oracle business intelligence
- oracle hospitality cruise fleet management
- oracle oss support tools
- oracle primavera unifier
- oracle siebel ui framework
- oracle weblogic server
Show 1 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jquery-uinpm |
before 1.12.0 | 1.12.0 |
jquery-ui-railsRubyGems |
before 6.0.0 | 6.0.0 |
org.webjars.npm:jquery-uiMaven |
before 1.12.0 | 1.12.0 |
jQuery.UI.CombinedNuGet |
before 1.12.0 | 1.12.0 |
jquery-uiTuxCare:npm |
1.10.4-tuxcare.0 up to 1.10.4-tuxcare.1, plus listed versions 1.10.4 |
1.10.4-tuxcare.1 |
jquery-uiTuxCare:npm |
1.10.3-tuxcare.0 up to 1.10.3-tuxcare.1, plus listed versions 1.10.3 |
1.10.3-tuxcare.1 |
jqueryuiDebian:12 |
before 1.12.1+dfsg-1 | 1.12.1+dfsg-1 |
jqueryuiDebian:13 |
before 1.12.1+dfsg-1 | 1.12.1+dfsg-1 |
jqueryuiDebian:14 |
before 1.12.1+dfsg-1 | 1.12.1+dfsg-1 |
drupal7Debian:9 |
before 7.52-2+deb9u17, plus listed versions 7.52-27.52-2+deb9u17.52-2+deb9u107.52-2+deb9u117.52-2+deb9u12 Show 12 moreShow less7.52-2+deb9u137.52-2+deb9u147.52-2+deb9u157.52-2+deb9u167.52-2+deb9u27.52-2+deb9u37.52-2+deb9u47.52-2+deb9u57.52-2+deb9u67.52-2+deb9u77.52-2+deb9u87.52-2+deb9u9 |
7.52-2+deb9u17 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jquery-ui-railsRubyGems |
before 6.0.0, plus listed versions 0.0.10.0.20.1.00.2.00.2.1 Show 30 moreShow less0.2.20.3.00.4.00.4.10.5.01.0.01.1.01.1.12.0.02.0.12.0.23.0.03.0.14.0.04.0.14.0.24.0.34.0.44.0.54.1.04.1.14.1.24.2.04.2.15.0.05.0.15.0.25.0.35.0.45.0.5 |
6.0.0 |
org.webjars.npm:jquery-uiMaven |
before 1.12.0, plus listed versions 1.10.41.10.51.12.0-rc.2 |
1.12.0 |
jQuery.UI.CombinedNuGet |
before 1.12.0, plus listed versions 1.10.01.10.11.10.21.10.31.10.4 Show 26 moreShow less1.11.01.11.11.11.21.11.31.11.41.8.101.8.111.8.121.8.131.8.141.8.151.8.161.8.171.8.181.8.191.8.201.8.20.11.8.211.8.221.8.231.8.241.8.91.9.01.9.0-RC11.9.11.9.2 |
1.12.0 |
python-XStatic-jquery-uiRed Hat:openstack:8::el7 |
before 0:1.12.0.1-1.el7ost | 0:1.12.0.1-1.el7ost |
python-XStatic-jquery-uiRed Hat:openstack:9::el7 |
before 0:1.12.0.1-1.el7ost | 0:1.12.0.1-1.el7ost |
python-XStatic-jquery-uiRed Hat:openstack:7::el7 |
before 0:1.12.0.1-1.el7ost | 0:1.12.0.1-1.el7ost |
python-XStatic-jquery-uiSUSE:OpenStack Cloud 7 |
before 1.11.0.1-2.3.1 | 1.11.0.1-2.3.1 |
jqueryuiUbuntu:Pro:14.04:LTS |
before 1.10.1+dfsg-1ubuntu0.14.04.1~esm1, plus listed versions 1.10.1+dfsg-1 |
1.10.1+dfsg-1ubuntu0.14.04.1~esm1 |
jqueryuiUbuntu:Pro:16.04:LTS |
before 1.10.1+dfsg-1ubuntu0.16.04.1~esm1, plus listed versions 1.10.1+dfsg-1 |
1.10.1+dfsg-1ubuntu0.16.04.1~esm1 |
jqueryuiUbuntu:Pro:18.04:LTS |
before 1.12.1+dfsg-5ubuntu0.18.04.1~esm3, plus listed versions 1.12.1+dfsg-51.12.1+dfsg-5ubuntu0.18.04.1~esm2 |
1.12.1+dfsg-5ubuntu0.18.04.1~esm3 |
jqueryuiUbuntu:20.04:LTS |
before 1.12.1+dfsg-5ubuntu0.20.04.1, plus listed versions 1.12.1+dfsg-5 |
1.12.1+dfsg-5ubuntu0.20.04.1 |
python-XStatic-jquery-uiopenSUSE:Tumbleweed |
before 1.13.0.1-1.15 | 1.13.0.1-1.15 |
python-XStatic-jquery-uiopenSUSE:Tumbleweed |
before 1.13.0.1-2.4 | 1.13.0.1-2.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
rhn.redhat.com/errata/RHSA-2017-0161.html
securityfocus.com/bid/104823
lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ
Show 58 moreShow less
oracle.com/security-alerts/cpuapr2020.html
github.com/jquery/jquery-ui/commit/9644e7bae9116edaf8d37c5b38cb32b892f10ff6
nodesecurity.io/advisories/127
tenable.com/security/tns-2016-19
jqueryui.com/changelog/1.12.0
security.netapp.com/advisory/ntap-20190416-0007
lists.debian.org/debian-lts-announce/2022/01/msg00014.html
drupal.org/sa-core-2022-002
nvd.nist.gov/vuln/detail/CVE-2016-7103
web.archive.org/web/20200227030100/http://www.securityfocus.com/bid/104823
security-tracker.debian.org/tracker/CVE-2016-7103
access.redhat.com/errata/RHSA-2016:2932
bugzilla.redhat.com/show_bug.cgi?id=1360286
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2932.json
cve.org/CVERecord?id=CVE-2016-7103
suse.com/support/update/announcement/2017/suse-su-20172351-1
bugzilla.suse.com/996004
ubuntu.com/security/CVE-2016-7103