{"action":"Upgrade jquery-ui to 1.13.2 or later.","affected":[{"fixed":"1.13.2","introduced":"0"}],"component":"jquery-ui","cve_ids":["CVE-2022-31160"],"ecosystem":"npm","epss":0.0269,"exploited":false,"fixed_versions":["1.13.2"],"ghsa_id":"GHSA-h6gj-6jjq-h8g9","id":"tcs_01M5KEKH80EJC8BKXFPG1AVXBT","modified_at":"2025-07-21T19:01:07.439663Z","published_at":"2022-07-18T17:07:36Z","references":["https://osv.dev/vulnerability/GHSA-h6gj-6jjq-h8g9","https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9","https://nvd.nist.gov/vuln/detail/CVE-2022-31160","https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9","https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released","https://github.com/jquery-ui-rails/jquery-ui-rails/blob/master/VERSIONS.md","https://github.com/jquery-ui-rails/jquery-ui-rails/releases/tag/v8.0.0-release","https://github.com/jquery/jquery-ui","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2022-31160.yml","https://lists.debian.org/debian-lts-announce/2022/12/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6","https://security.netapp.com/advisory/ntap-20220909-0007","https://www.drupal.org/sa-contrib-2022-052"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-h6gj-6jjq-h8g9","url":"https://osv.dev/vulnerability/GHSA-h6gj-6jjq-h8g9"}],"summary":"jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label"}