ZDF
Sign inSign up

Vulnerabilities

Threat intelligence · CVE-2021-41184

jQuery-UI is the official jQuery user interface library.

Published Oct 26, 2021 · catalog updated Nov 2, 2026 · jquery ui

Last checked Nov 8, 2026. A connected source was read within the last 7 days.

Check this week

CVE-2021-41184 is not in CISA KEV. FIRST estimates a 40.77% chance of exploitation in the next 30 days. Check whether you run jquery ui.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
40.77%
Remediation
Version ranges on file
Affected products
cpe drupal/drupal · cpe jqueryui/jquery ui · cpe oracle/agile product lifecycle management · cpe oracle/application express · cpe oracle/banking platform · cpe tenable/tenable.sc

Drupal Developers Warn Users about Vulnerabilities in jQuery UI Drupal developers warned users about several vulnerabilities discovered in a third-party library, jQuery UI. The library was recently resurrected after it had apparently been discontinued. XSS bugs fixed A new version of jQuery UI was released in October 2021, but the project was previously believed to have reached the end of life as this had been the fi

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe drupal/drupal< 7.86
  • cpe drupal/drupal< 9.2.11
  • cpe drupal/drupal< 9.3.3
  • cpe jqueryui/jquery ui< 1.13.0
  • cpe oracle/agile product lifecycle management9.3.6
  • cpe oracle/application express< 22.1.1
  • cpe oracle/banking platform2.9.0
  • cpe tenable/tenable.sc< 5.21.0

How to fix CVE-2021-41184

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2021-41184 is not in CISA KEV. FIRST estimates a 40.77% chance of exploitation in the next 30 days. Check whether you run jquery ui.

Which versions are affected?

Compare what you have installed with jqueryui/jquery ui < 1.13.0; oracle/agile product lifecycle management 9.3.6; oracle/application express < 22.1.1; oracle/banking platform 2.9.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-79: Cross-site Scripting (XSS). EPSS 40.77%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Drupal security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 21, 2022 · AlienVault OTX

    Detected

    Drupal Developers Warn Users about Vulnerabilities in jQuery UI Drupal developers warned users about several vulnerabilities discovered in a third-party library, jQuery UI. The library was recently resurrected after it had apparently been discontinued. XSS bugs fixed A new version of jQuery UI was released in October 2021, but the project was previously believed to have reached the end of life as

  2. Nov 2, 2026 · NIST NVD

    Updated

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the option of the util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the option is now treated as a CSS selector. A workaround is to not accept the value of the option from untrusted sources.

Sources

  • CVE.orgVulnerability recordCVE-2021-41184

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2021-41184

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the option of the util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the option

    nvd.nist.gov
  • AlienVault OTXThreat intelligenceCVE-2021-41184
    otx.alienvault.com

References

Freshness

Last verified in this catalog Nov 8, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • CVE.orgNov 4, 2026
  • NIST NVDNov 3, 2026
  • AlienVault OTXNov 2, 2026