GHSA-j7qv-pgf6-hvh4 XSS in `*Text` options of the Datepicker widget in jquery-ui

• npm jquery-ui: < 1.13.0 → fixed in 1.13.0 • Maven org.webjars.npm:jquery-ui: < 1.13.0 → fixed in 1.13.0 • RubyGems jquery-ui-rails: < 7.0.0 → fixed in 7.0.0 • NuGet jQuery.UI.Combined: < 1.13.0 → fixed in 1.13.0

Impact Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "doEvilThing( 'closeText XSS' )", currentText: "doEvilThing( 'currentText XSS' )", prevText: "doEvilThing( 'prevText XSS' )", nextText: "doEvilThing( 'nextText XSS' )", buttonText: "doEvilThing( 'buttonText XSS' )", appendText: "doEvilThing( 'appendText XSS' )", } ); ``` will call `doEvilThing` with 6 different parameters coming from all `*Text` options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the `*Text` options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.