CVE-2022-31160

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

• CWE-79

• https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/Release Notes, Vendor Advisory
• https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9Patch, Third Party Advisory
• https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9Exploit, Mitigation, Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6/
• https://security.netapp.com/advisory/ntap-20220909-0007/Third Party Advisory
• https://www.drupal.org/sa-contrib-2022-052Third Party Advisory
• https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/Release Notes, Vendor Advisory
• https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9Patch, Third Party Advisory
• https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9Exploit, Mitigation, Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6/
• https://security.netapp.com/advisory/ntap-20220909-0007/Third Party Advisory
• https://www.drupal.org/sa-contrib-2022-052Third Party Advisory

Published

Jul 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31155Sourcegraph is an opensource code search and navigation engi…4.3
• CVE-2022-31156Gradle is a build tool. Dependency verification is a securit…4.4
• CVE-2022-31157LTI 1.3 Tool Library is a library used for building IMS-cert…7.5
• CVE-2022-31158LTI 1.3 Tool Library is a library used for building IMS-cert…7.5
• CVE-2022-31159The AWS SDK for Java enables Java developers to work with Am…6.5
• CVE-2022-3116The Heimdal Software Kerberos 5 implementation is vulnerable…7.5
• CVE-2022-31161Roxy-WI is a Web interface for managing HAProxy, Nginx and K…9.8
• CVE-2022-31162Slack Morphism is an async client library for Rust. Prior to…7.5
• CVE-2022-31163TZInfo is a Ruby library that provides access to time zone d…8.1
• CVE-2022-31164Tovy is a a staff management system for Roblox groups. A vul…7.5
• CVE-2022-31166XWiki Platform Old Core is a core package for XWiki Platform…8.8
• CVE-2022-31167XWiki Platform Security Parent POM contains the security API…6.5