# CVE-2022-31160: libjs-jquery-ui: jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery

CVE-2022-31160 is fixed in 4 products on 1 platform, first by libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm2, released July 20, 2022. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-31160
- Priority: Routine
- CVSS: 6.1 (Medium)
- EPSS: 0.0269
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 20, 2022

## Description

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | jqueryui Debian 12.15 (bookworm) | 1.13.2+dfsg-1 | [DEBIAN-CVE-2022-31160](https://patchblox.com/security/data/fix/linux/debian-cve-2022-31160.md) | Jul 20, 2022 |
| Linux | jqueryui Debian 13.5 (trixie) | 1.13.2+dfsg-1 | [DEBIAN-CVE-2022-31160](https://patchblox.com/security/data/fix/linux/debian-cve-2022-31160.md) | Jul 20, 2022 |
| Linux | jqueryui Debian 14 | 1.13.2+dfsg-1 | [DEBIAN-CVE-2022-31160](https://patchblox.com/security/data/fix/linux/debian-cve-2022-31160.md) | Jul 20, 2022 |
| Linux | libjs-jquery-ui Ubuntu 18.04.6 LTS (bionic) | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | [libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjs-jquery-ui-1.12.1-dfsg-5ubuntu0.18.04.1-esm2.md) | Jul 20, 2022 |
| Linux | libjs-jquery-ui Ubuntu 20.04 LTS (focal) | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | [libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.20.04.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libjs-jquery-ui-1.12.1-dfsg-5ubuntu0.20.04.1-esm3.md) | Jul 20, 2022 |
| Linux | libjs-jquery-ui Ubuntu 22.04.1 LTS (jammy) | 1.13.1+dfsg-1ubuntu0.1~esm1 | [libjs-jquery-ui 1.13.1+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libjs-jquery-ui-1.13.1-dfsg-1ubuntu0.1-esm1.md) | Jul 20, 2022 |
| Linux | libjs-jquery-ui-docs Ubuntu 18.04.6 LTS (bionic) | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | [libjs-jquery-ui-docs 1.12.1+dfsg-5ubuntu0.18.04.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjs-jquery-ui-docs-1.12.1-dfsg-5ubuntu0.18.04.1-esm2.md) | Jul 20, 2022 |
| Linux | libjs-jquery-ui-docs Ubuntu 20.04 LTS (focal) | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | [libjs-jquery-ui-docs 1.12.1+dfsg-5ubuntu0.20.04.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libjs-jquery-ui-docs-1.12.1-dfsg-5ubuntu0.20.04.1-esm3.md) | Jul 20, 2022 |
| Linux | libjs-jquery-ui-docs Ubuntu 22.04.1 LTS (jammy) | 1.13.1+dfsg-1ubuntu0.1~esm1 | [libjs-jquery-ui-docs 1.13.1+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libjs-jquery-ui-docs-1.13.1-dfsg-1ubuntu0.1-esm1.md) | Jul 20, 2022 |
| Linux | node-jquery-ui Ubuntu 18.04.6 LTS (bionic) | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | [node-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-node-jquery-ui-1.12.1-dfsg-5ubuntu0.18.04.1-esm2.md) | Jul 20, 2022 |
| Linux | node-jquery-ui Ubuntu 20.04 LTS (focal) | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | [node-jquery-ui 1.12.1+dfsg-5ubuntu0.20.04.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-node-jquery-ui-1.12.1-dfsg-5ubuntu0.20.04.1-esm3.md) | Jul 20, 2022 |
| Linux | node-jquery-ui Ubuntu 22.04.1 LTS (jammy) | 1.13.1+dfsg-1ubuntu0.1~esm1 | [node-jquery-ui 1.13.1+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-node-jquery-ui-1.13.1-dfsg-1ubuntu0.1-esm1.md) | Jul 20, 2022 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.