The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check whether your site or app uses the jQuery UI Dialog widget and whether the dialog title is built from user-controlled or external content (for example, query strings, form fields, or messages).
Identify your exact jQuery UI version in your front-end bundle or dependency (e.g., jquery-ui, jquery.ui.combined, or the equivalent package you ship).
Upgrade to a fixed version: jQuery UI 1.10.0 (jquery-ui, org.webjars.npm:jquery-ui, jquery.ui.combined, jquery ui) or jquery-ui-rails 4.0.0 where applicable.
After upgrading, test dialogs specifically by passing HTML-like characters into any title inputs you control, and confirm the title renders as plain text (not executable HTML).
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
In plain language
Written by AI from the record
This is a jQuery UI dialog bug (before 1.10.0) that lets a malicious website put its own script into a dialog’s title, so typical small businesses should update if they use jQuery UI Dialog with an unsafely set title.
Cross-site scripting (CWE-79) in the jQuery UI Dialog widget (jquery.ui.dialog.js) before 1.10.0 allows remote attackers to inject and execute arbitrary HTML/script in a user’s browser via the Dialog widget’s unsanitized `title` option when a user visits a malicious page and uses the dialog with a crafted title.
If you're affected
Account/session hijacking risk
Website defacement or popup attacks
Customer data exposure
Malicious actions as the user
What is it
jQuery UI is a common library used to build interactive web pages. This bug is specifically about the text shown at the top of a dialog box (the dialog “title”). If the title is set in a way that doesn’t clean up dangerous characters, an attacker can trick the browser into running attacker-supplied script as if it came from your site.
Think of it like letting someone slip a note into a locked briefcase labeled “from us,” and the browser treats that note as trustworthy.
Who is affected
This matters if you use jQuery UI Dialog in your website or web app and set the dialog title based on data that could come from users or from content an attacker can influence.
It’s a risk even without any logins, but only when the vulnerable dialog is actually reached in the user’s browser and the attacker can get a crafted title value to be used (user must visit a malicious page and user interaction is required).
How urgent is it
This is AMBER because attackers don’t need an account, and the bug allows injecting and running script in a victim’s browser once a user interacts with a malicious page. While it’s not confirmed as a CISA KEV item, there is a public proof-of-concept and the predicted likelihood is rising, so you should patch if you’re using jQuery UI Dialog before 1.10.0.
What to do — in detail
Confirm exposure in your code/dependencies
Search your front-end code for use of the Dialog widget (typically something that initializes a dialog with an option named title).
Determine where the title value comes from:
Safe: a constant string you fully control.
Risky: anything influenced by user input (form fields), URL parameters, stored messages, API responses, or error messages that could include attacker-controlled text.
Check the version of jQuery UI you ship:
If you bundle jquery-ui, jquery.ui.combined, or similar, confirm whether it is before 1.10.0.
If you use jquery-ui-rails, confirm whether it is before 4.0.0.
Identify the correct fixed version by package
jQuery UI (jquery-ui, org.webjars.npm:jquery-ui, jquery.ui.combined, jquery ui): upgrade to 1.10.0.
jquery-ui-rails: upgrade to 4.0.0.
Upgrade
Update the dependency to the fixed version, rebuild, and redeploy.
Validate after the upgrade
In a staging environment, exercise any dialogs that accept external/user-influenced title text.
Use a test title that includes HTML/script-like characters. After upgrading, verify the title displays as plain text and does not execute.
Temporary workaround (if you must delay patching)
Stop passing untrusted content directly into the dialog title option.
Ensure any dynamic title content is treated as plain text (not interpreted as HTML). If you currently allow HTML in titles, remove that behavior.
What to monitor
Look for unexpected dialog behavior on pages that use jQuery UI Dialog.
Monitor customer reports of popups, redirected pages, or unexpected messages—common symptoms of script injection.
Note on timelines: There is no CISA KEV listing for this issue in the provided findings, so focus on fixing based on whether your deployed configuration and usage matches the vulnerable pattern (Dialog title set from untrusted content).
Technical context
Vulnerability: CVE-2010-5312 — Cross-site scripting (XSS) in jQuery UI Dialog (jquery.ui.dialog.js) in the Dialog widget, affecting jQuery UI before 1.10.0.
Mechanism: The Dialog widget processes the title option without proper sanitization, allowing a malicious page to inject arbitrary HTML/script that executes in the context of the user’s browser.
Attack vector and reachability: Remote attacker via a maliciously crafted web page; authentication is not required. The user must interact with the malicious page, and the dialog must be used with a title option that is not properly sanitized.
Exploitation status: Public proof-of-concept exists (2 known). No KEV listing was found in the provided findings.
Severity/likelihood: Reported as medium (CVSS 6.1). EPSS is predicted at 18.4% with a rising trend, but this is a prediction and not a substitute for confirming actual exposure in your implementation.
Fix: jQuery UI 1.10.0 (and jquery-ui-rails 4.0.0) resolves the issue per the provided patch findings.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
