[GHSA-h6gj-6jjq-h8g9] jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label

[Borzik]

Updates

• Affected products

Comments
jquery-ui-rails has been updated to use jquery-ui 1.14.1 which does not have this vulnerability.

[github]

Hi there @mgol! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull Request Overview

This PR updates the advisory for the jQuery UI XSS vulnerability by revising package ecosystems, names, and fixed version ranges to accurately reflect the patched vulnerabilities.

• Updated the modified timestamp.
• Swapped package ecosystem and name assignments between RubyGems and NuGet entries.
• Updated the fixed version numbers and added a database-specific field for the RubyGems entry.

Comments suppressed due to low confidence (2)

advisories/github-reviewed/2022/07/GHSA-h6gj-6jjq-h8g9/GHSA-h6gj-6jjq-h8g9.json:58

• The package details have been swapped between RubyGems and NuGet; please confirm that the new assignments correctly reflect the intended vulnerability mapping and that the package names are accurate for each ecosystem.

        "ecosystem": "NuGet",

advisories/github-reviewed/2022/07/GHSA-h6gj-6jjq-h8g9/GHSA-h6gj-6jjq-h8g9.json:88

• The fixed version for the RubyGems entry is updated to '8.0.0' while the NuGet entry uses '1.13.2'; please verify that these differing version numbers are correct according to each ecosystem's versioning scheme.

              "fixed": "8.0.0"

[mgol]

Why are you changing the order of packages? That makes the PR much harder to read.

[Borzik]

@mgol I used the "See something to contribute? Suggest improvements for this vulnerability." link on the advisory page which opens up a form; the only thing I did there is added 8.0.0 to jquery-ui-rails' "Patched versions" field. I guess the form's parameter parsing doesn't preserve package list.

[mgol]

I see. No further comments then.