{"id":"CVE-2016-7103","aliases":["CLSA-2026-1773188127","CLSA-2026-1792502475","DEBIAN-CVE-2016-7103","DLA-2889-1","EUVD-2017-0253","GHSA-hpcf-8vf9-q4gj","RHSA-2016:2932","RHSA-2016:2933","RHSA-2017:0161","SUSE-SU-2017:2351-1","UBUNTU-CVE-2016-7103","USN-6419-1","openSUSE-SU-2024:11214-1","openSUSE-SU-2024:14131-1","openSUSE-SU-2026:11997-1"],"status":"published","title":"jQuery-UI vulnerable to Cross-site Scripting in dialog closeText","description":"Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.29186,"percentile":0.98184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2017-03-15T00:00:00Z","modified":"2026-10-24T10:47:21Z","fixes":[{"ecosystem":"npm","package":"jquery-ui","fixed_in":["1.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"jquery-ui-rails","fixed_in":["6.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.npm:jquery-ui","fixed_in":["1.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"jQuery.UI.Combined","fixed_in":["1.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jqueryui","fixed_in":["1.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jqueryui","fixed_in":["1.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jqueryui","fixed_in":["1.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"python-XStatic-jquery-ui","fixed_in":["0:1.12.0.1-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-XStatic-jquery-ui","fixed_in":["0:1.12.0.1-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-XStatic-jquery-ui","fixed_in":["0:1.12.0.1-1.el7ost"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-XStatic-jquery-ui","fixed_in":["1.11.0.1-2.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jqueryui","fixed_in":["1.10.1+dfsg-1ubuntu0.14.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jqueryui","fixed_in":["1.10.1+dfsg-1ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-XStatic-jquery-ui","fixed_in":["1.13.0.1-1.15","1.13.0.1-2.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"jquery-ui-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"jQuery.UI.Combined","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.4-tuxcare.0"},{"fixed":"1.10.4-tuxcare.1"}]}],"versions":["1.10.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.3-tuxcare.0"},{"fixed":"1.10.3-tuxcare.1"}]}],"versions":["1.10.3"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52-2+deb9u17"}]}],"versions":["7.52-2","7.52-2+deb9u1","7.52-2+deb9u10","7.52-2+deb9u11","7.52-2+deb9u12","7.52-2+deb9u13","7.52-2+deb9u14","7.52-2+deb9u15","7.52-2+deb9u16","7.52-2+deb9u2","7.52-2+deb9u3","7.52-2+deb9u4","7.52-2+deb9u5","7.52-2+deb9u6","7.52-2+deb9u7","7.52-2+deb9u8","7.52-2+deb9u9"],"bundled":4},{"source":"osv","ecosystem":"npm","package":"jquery-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"jquery-ui-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","0.2.2","0.3.0","0.4.0","0.4.1","0.5.0","1.0.0","1.1.0","1.1.1","2.0.0","2.0.1","2.0.2","3.0.0","3.0.1","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.1.0","4.1.1","4.1.2","4.2.0","4.2.1","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}],"versions":["1.10.4","1.10.5","1.12.0-rc.2"]},{"source":"osv","ecosystem":"NuGet","package":"jQuery.UI.Combined","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.20","1.8.20.1","1.8.21","1.8.22","1.8.23","1.8.24","1.8.9","1.9.0","1.9.0-RC1","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.0.1-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.0.1-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.0.1-1.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0.1-2.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.14.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.14.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1+dfsg-1ubuntu0.16.04.1~esm1"}]}],"versions":["1.10.1+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-5ubuntu0.18.04.1~esm3"}]}],"versions":["1.12.1+dfsg-5","1.12.1+dfsg-5ubuntu0.18.04.1~esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jqueryui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1+dfsg-5ubuntu0.20.04.1"}]}],"versions":["1.12.1+dfsg-5"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-1.15"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-2.4"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jqueryui","product":"jquery_ui"},{"vendor":"juniper","product":"junos"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"oracle","product":"application_express"},{"vendor":"oracle","product":"business_intelligence"},{"vendor":"oracle","product":"hospitality_cruise_fleet_management"},{"vendor":"oracle","product":"oss_support_tools"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"siebel_ui_framework"},{"vendor":"oracle","product":"weblogic_server"},{"vendor":"redhat","product":"openstack"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2017-0161.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2933.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2932.html","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/104823","tags":["vdb-entry","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/jquery/jquery-ui/commit/9644e7bae9116edaf8d37c5b38cb32b892f10ff6","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/jquery/api.jqueryui.com/issues/281","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nodesecurity.io/advisories/127","tags":["x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://www.tenable.com/security/tns-2016-19","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://jqueryui.com/changelog/1.12.0/","tags":["x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.drupal.org/sa-core-2022-002","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7103","tags":["advisory"]},{"url":"https://github.com/jquery/jquery-ui/pull/1622","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6@%3Ccommits.roller.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/"},{"url":"https://github.com/jquery-ui-rails/jquery-ui-rails/commit/d504a40538fe5f7998439ad2f8fc5c4a1f843f1c","tags":["web"]},{"url":"https://web.archive.org/web/20200227030100/http://www.securityfocus.com/bid/104823","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2016-7103.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hpcf-8vf9-q4gj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7103","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0007","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2I4UHPIW26FIALH7GGZ3IYUUA53VOOJ","tags":["web"]},{"url":"https://jqueryui.com/changelog/1.12.0","tags":["web"]},{"url":"https://github.com/jquery/jquery-ui","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2932","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1360286","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2932.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7103","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2933","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2933.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0161","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0161.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172351-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/996004","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7103","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7103","tags":["report"]},{"url":"https://github.com/jquery/jquery-ui/pull/1632","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6419-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-41182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31160","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-7103","description":"Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.","status":"published","published":"2017-03-15T00:00:00Z","modified":"2024-08-06T01:50:47.467Z","updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2017-0253","description":"Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.","status":"published","published":"2017-03-15T00:00:00Z","modified":"2024-08-06T01:50:47Z","updated_at":"2026-11-03T02:22:33.482405Z"}],"ghsa":[{"id":"GHSA-hpcf-8vf9-q4gj","title":"jQuery-UI vulnerable to Cross-site Scripting in dialog closeText","description":"Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. \n\njQuery-UI is a library for manipulating UI elements via jQuery.\n\nVersion 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog`  function.  If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.\n\n\n## Recommendation\n\nUpgrade to jQuery-UI 1.12.0 or later.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2023-09-26T17:58:16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2016-7103","description":"Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.","status":"published","published":"2017-03-15T16:59:00.173Z","modified":"2026-06-17T00:52:35.863Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-7103","description":"Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.","status":"published","published":"2017-03-15T16:59:00.173Z","modified":"2026-10-24T10:47:21.886951726Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-7103","description":"Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.","status":"published","published":"2017-03-15T16:59:00.173Z","modified":"2026-09-22T07:00:28.669599224Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"GHSA-hpcf-8vf9-q4gj","title":"jQuery-UI vulnerable to Cross-site Scripting in dialog closeText","description":"Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. \n\njQuery-UI is a library for manipulating UI elements via jQuery.\n\nVersion 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog`  function.  If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.\n\n\n## Recommendation\n\nUpgrade to jQuery-UI 1.12.0 or later.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2024-03-11T05:20:56.476279Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"RHSA-2016:2932","title":"Red Hat Security Advisory: python-XStatic-jquery-ui security update","status":"published","published":"2024-09-13T14:37:21Z","modified":"2026-06-29T10:14:39Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2933","title":"Red Hat Security Advisory: python-XStatic-jquery-ui security update","status":"published","published":"2024-09-13T14:37:53Z","modified":"2026-06-29T10:14:39Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2017:0161","title":"Red Hat Security Advisory: python-XStatic-jquery-ui security update","status":"published","published":"2024-09-13T14:38:02Z","modified":"2026-06-29T10:14:52Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-7103","description":"Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.","status":"published","published":"2017-03-15T16:59:00Z","modified":"2026-02-04T03:21:16.755659Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"CLSA-2026-1773188127","title":"TuxCare security update for jquery-ui (5 CVEs)","description":"TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.746326008Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1792502475","title":"TuxCare security update for jquery-ui (5 CVEs)","description":"TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.3-tuxcare.1.","status":"published","published":"2026-10-20T13:21:15Z","modified":"2026-10-20T19:30:09.970385564Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"DLA-2889-1","title":"drupal7 - security update","status":"published","published":"2022-01-19T00:00:00Z","modified":"2026-03-09T01:20:29.641946Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2024:11214-1","title":"python36-XStatic-jquery-ui-1.12.1.1-2.11 on GA media","description":"These are all security issues fixed in the python36-XStatic-jquery-ui-1.12.1.1-2.11 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:11.478015Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14131-1","title":"python310-XStatic-jquery-ui-1.13.0.1-1.15 on GA media","description":"These are all security issues fixed in the python310-XStatic-jquery-ui-1.13.0.1-1.15 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T02:32:43.251278Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11997-1","title":"python313-XStatic-jquery-ui-1.13.0.1-2.4 on GA media","description":"These are all security issues fixed in the python313-XStatic-jquery-ui-1.13.0.1-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:25.338213107Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2017:2351-1","title":"Security update for python-XStatic-jquery-ui","description":"This update for python-XStatic-jquery-ui fixes the following issues:\n\n-  CVE-2016-7103: possible cross-site scripting in dialog closeText could lead to arbitrary code injection (bsc#996004)\n","status":"published","published":"2017-09-05T12:41:41Z","modified":"2026-02-04T03:29:55.860731Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-6419-1","title":"jqueryui vulnerabilities","description":"Hong Phat Ly discovered that jQuery UI did not properly manage parameters\nfrom untrusted sources, which could lead to arbitrary web script or HTML\ncode injection. A remote attacker could possibly use this issue to perform\na cross-site scripting (XSS) attack. This issue only affected\nUbuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)\n\nEsben Sparre Andreasen discovered that jQuery UI did not properly handle\nvalues from untrusted sources in the Datepicker widget. A remote attacker\ncould possibly use this issue to perform a cross-site scripting (XSS)\nattack and execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-41182, CVE-2021-41183)\n\nIt was discovered that jQuery UI did not properly validate values from\nuntrusted sources. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 20.04 LTS. (CVE-2021-41184)\n\nIt was discovered that the jQuery UI checkboxradio widget did not properly\ndecode certain values from HTML entities. An attacker could possibly use\nthis issue to perform a cross-site scripting (XSS) attack and cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 20.04 LTS. (CVE-2022-31160)\n","status":"published","published":"2023-10-05T12:36:27Z","modified":"2026-06-29T13:50:58.084523349Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}