—

DRUPAL-CONTRIB-2022-052

Details

jQuery UI is a third-party library used by Drupal. The jQuery UI Checkboxradio module provides the jQuery UI Checkboxradio library (which was previously in Drupal 8 core, but has since been removed from core and moved to this module).

As part of the jQuery UI 1.13.2 update, the jQuery UI project disclosed following security issue that may affect sites using the jQuery UI Checkboxradio module:

* CVE-2022-31160: [XSS when refreshing a checkboxradio with an HTML-like initial text label](https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9)

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/jquery_ui_checkboxradio

Introduced in: 0Fixed in: 1.4.0

Upgrade drupal/jquery_ui_checkboxradio to 1.4.0 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2022-052[WEB]