GHSA-gpqq-952q-5327 XSS in the `of` option of the `.position()` util in jquery-ui

• npm jquery-ui: < 1.13.0 → fixed in 1.13.0 • Maven org.webjars.npm:jquery-ui: < 1.13.0 → fixed in 1.13.0 • NuGet jQuery.UI.Combined: < 1.13.0 → fixed in 1.13.0 • RubyGems jquery-ui-rails: < 7.0.0 → fixed in 7.0.0

Impact Accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. For example, invoking the following code: ```js $( "#element" ).position( { my: "left top", at: "right bottom", of: "", collision: "none" } ); ``` will call the `doEvilThing()` function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the `of` option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.