jQuery-UI vulnerable to Cross-site Scripting in dialog closeText (GHSA-hpcf-8vf9-q4gj)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2016-7103
Severity: MODERATE · CWE: CWE-79

Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. 

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog`  function.  If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.


## Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

Affected packages:
package: ecosystem: npm
name: jquery-ui
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.12.0
package: ecosystem: RubyGems
name: jquery-ui-rails
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.0.0
package: ecosystem: Maven
name: org.webjars.npm:jquery-ui
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.12.0
package: ecosystem: NuGet
name: jQuery.UI.Combined
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.12.0