DRUPAL-CORE-2022-001 in drupal/core
Published 19 Jan 2022 · Updated 19 Sept 2026
Affected package
- Affected
- >=8.0.0 <9.2.11 · >=9.3.0 <9.3.3
- Fixed in
- 9.2.11, 9.3.3
composer require drupal/core:^9.3.3Details
jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life.
Late in 2021, jQuery UI announced that they would be continuing development, and released a jQuery UI 1.13.0 version. As part of this 1.13.0 update, they disclosed the following security issue that may affect Drupal 9 and 7:
- CVE-2021-41184: XSS in the `of` option of the `.position()` util
It is possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release applies the fix for the above cross-site description issue, without making any of the other changes to the jQuery version that is included in Drupal.
This advisory is not covered by [Drupal Steward](/steward).
Is DRUPAL-CORE-2022-001 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.