CVE-2021-41184: XSS in the `of` option of the `.position()` util in jquery-ui

(updated )

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:

$( "#element" ).position( {
my: "left top",
at: "right bottom",
of: "<img onerror='doEvilThing()' src='/404' />",
collision: "none"
} );

will call the doEvilThing() function.

References

Code Behaviors & Features

Detect and mitigate CVE-2021-41184 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →