CVE-2022-31160

Deeper analysis

jQuery UI versions prior to 1.13.2 contain a cross-site scripting vulnerability in the checkboxradio widget. When an input element is enclosed in a label and the widget is initialized on that input, the parent label contents are treated as the input label. Invoking the refresh method on such a widget causes any encoded HTML entities present in the initial markup to be decoded and rendered, which can result in script execution.

An attacker who can supply or influence the initial HTML markup containing a checkboxradio widget can trigger the flaw by arranging for the refresh method to be called after page load. Successful exploitation yields cross-site scripting capabilities that allow reading or modifying page contents and performing actions in the context of the affected origin, with the CVSS vector reflecting network attack vector, no authentication requirement, and required user interaction.

Advisories and the patch release note that the issue is resolved in jQuery UI 1.13.2. As a workaround when upgrading is not immediately feasible, any non-input contents inside the label element can be wrapped in a span tag to prevent the erroneous decoding behavior.

The EPSS score rose from a low baseline to a peak of 0.1526, indicating that exploitation interest emerged after disclosure before receding to the current value of 0.0776.