CVE-2022-31160

Name	CVE-2022-31160
Description	jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3230-1, ELA-752-1
Debian Bugs	1015982

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jqueryui (PTS)	jessie, jessie (lts)	1.10.1+dfsg-1+deb8u1	fixed
	stretch (lts), stretch	1.12.1+dfsg-4+deb9u1	fixed
	buster (security), buster, buster (lts)	1.12.1+dfsg-5+deb10u1	fixed
	bullseye	1.12.1+dfsg-8+deb11u2	fixed
	sid, trixie, bookworm	1.13.2+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
jqueryui	source	jessie	(not affected)
jqueryui	source	stretch	1.12.1+dfsg-4+deb9u1	ELA-752-1
jqueryui	source	buster	1.12.1+dfsg-5+deb10u1	DLA-3230-1
jqueryui	source	bullseye	1.12.1+dfsg-8+deb11u2
jqueryui	source	(unstable)	1.13.2+dfsg-1		1015982

Notes

https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9
https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9 (1.13.2)
[jessie] - jqueryui <not-affected> (Vulnerable code introduced later)