search

swisnl / jQuery-contextMenu

jQuery contextMenu plugin & polyfill
https://swisnl.github.io/jQuery-contextMenu/
MIT License
2.25k stars 744 forks source link

Security - CVE-2021-41184: Upgrade embedded jQuery UI Position to 1.13+ (v2.x) #765

Open Jason-Morcos opened 1 year ago

Jason-Morcos commented 1 year ago

This plugin embeds jQuery UI Position v1.12 (https://github.com/swisnl/jQuery-contextMenu/blob/master/dist/jquery.ui.position.js). This version of jQuery UI is susceptible to Cross Site Scripting and is officially unsupported by jQuery UI.

Upgrading this embedded code to jQuery UI 1.13 closes these known security vulnerabilities.

CVE: https://www.cve.org/CVERecord?id=CVE-2021-41184 / https://security.snyk.io/vuln/SNYK-JS-JQUERYUI-1767175 jQuery UI: https://jqueryui.com