CVE catalog

CVE-2022-31160

jqueryui affected and fixed versions

[CVE catalog]

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.69% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiejqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]
Debiansidjqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]
Debiansidjqueryui1.14.2+dfsg-1Fixed[CVE-2022-31160]
Debianforkyjqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]
Debianforkyjqueryui1.14.2+dfsg-1Fixed[CVE-2022-31160]
Debianbookwormjqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]

Showing 6 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormjqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]
Debianforkyjqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]
Debianforkyjqueryui1.14.2+dfsg-1Fixed[CVE-2022-31160]
Debiansidjqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]
Debiansidjqueryui1.14.2+dfsg-1Fixed[CVE-2022-31160]
Debiantrixiejqueryui1.13.2+dfsg-1FixedDistribution-reported fixed boundary[CVE-2022-31160]
Ubuntu20.04jqueryui1.12.1+dfsg-5UnknownSource applicability is not established[UBUNTU-CVE-2022-31160]
Ubuntu20.04jqueryui1.12.1+dfsg-5ubuntu0.20.04.1UnknownSource applicability is not established[UBUNTU-CVE-2022-31160]
Ubuntuprojqueryui1.12.1+dfsg-8UnknownSource applicability is not established[UBUNTU-CVE-2022-31160]
Ubuntuprojqueryui1.13.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2022-31160]
Ubuntuprojqueryui1.13.1+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2022-31160]
Ubuntuprojqueryui1.13.1+dfsg-1ubuntu0.1~esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-31160]
Original provider fields
{
  "package_releases": [
    {
      "name": "jqueryui",
      "status": "fixed",
      "release": "sid",
      "version": "1.14.2+dfsg-1"
    },
    {
      "name": "jqueryui",
      "status": "fixed",
      "release": "forky",
      "version": "1.14.2+dfsg-1"
    },
    {
      "name": "jqueryui",
      "status": "fixed",
      "release": "trixie",
      "version": "1.13.2+dfsg-1"
    },
    {
      "name": "jqueryui",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.13.2+dfsg-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1015982,
      "name": "jqueryui",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.13.2+dfsg-1"
    },
    {
      "bug": 1015982,
      "name": "jqueryui",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.13.2+dfsg-1"
    },
    {
      "bug": 1015982,
      "name": "jqueryui",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.13.2+dfsg-1"
    },
    {
      "bug": 1015982,
      "name": "jqueryui",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.13.2+dfsg-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "jqueryui",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.1+dfsg-1ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.12.1+dfsg-8",
        "1.13.0+dfsg-1",
        "1.13.1+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31160",
      "fixed_version": "1.13.1+dfsg-1ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31160",
      "provider_updated_at": "2026-02-04T03:23:53.171400Z",
      "applicability_unknown": true
    },
    {
      "name": "jqueryui",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.1+dfsg-5ubuntu0.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.12.1+dfsg-5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31160",
      "fixed_version": "1.12.1+dfsg-5ubuntu0.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31160",
      "provider_updated_at": "2026-02-04T03:23:53.171400Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1015982]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libjs-jquery-ui]Unknown

    Source package: [jqueryui]

    Details (2)

    • 1.13.2+dfsg-1 · all · bookworm

      Fixed · Fixed: 1.13.2+dfsg-1

      dsa · jqueryui · debian · bookworm

    • 1.13.2+dfsg-1 · all · bookworm

      Fixed · Fixed: 1.13.2+dfsg-1

      dsa · jqueryui · debian · bookworm

  • [libjs-jquery-ui-docs]Unknown

    Source package: [jqueryui]

    Details (2)

    • 1.13.2+dfsg-1 · all · bookworm

      Fixed · Fixed: 1.13.2+dfsg-1

      dsa · jqueryui · debian · bookworm

    • 1.13.2+dfsg-1 · all · bookworm

      Fixed · Fixed: 1.13.2+dfsg-1

      dsa · jqueryui · debian · bookworm

  • [node-jquery-ui]Unknown

    Source package: [jqueryui]

    Details (2)

    • 1.13.2+dfsg-1 · all · bookworm

      Fixed · Fixed: 1.13.2+dfsg-1

      dsa · jqueryui · debian · bookworm

    • 1.13.2+dfsg-1 · all · bookworm

      Fixed · Fixed: 1.13.2+dfsg-1

      dsa · jqueryui · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]