CVE-2010-5312

jQuery UI is a common library used to build interactive web pages. This bug is specifically about the text shown at the top of a dialog box (the dialog “title”). If the title is set in a way that doesn’t clean up dangerous characters, an attacker can trick the browser into running attacker-supplied script as if it came from your site.

Think of it like letting someone slip a note into a locked briefcase labeled “from us,” and the browser treats that note as trustworthy.

This matters if you use jQuery UI Dialog in your website or web app and set the dialog title based on data that could come from users or from content an attacker can influence.

It’s a risk even without any logins, but only when the vulnerable dialog is actually reached in the user’s browser and the attacker can get a crafted title value to be used (user must visit a malicious page and user interaction is required).

This is AMBER because attackers don’t need an account, and the bug allows injecting and running script in a victim’s browser once a user interacts with a malicious page. While it’s not confirmed as a CISA KEV item, there is a public proof-of-concept and the predicted likelihood is rising, so you should patch if you’re using jQuery UI Dialog before 1.10.0.