jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
ImpactInitializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.For example, starting with the following initial secure HTML:and calling:will turn the initial HTML into:and the alert will get executed.PatchesThe bug has been patched in jQuery UI 1.13.2.WorkaroundsTo remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the `label` in a `span`:Referenceshttps://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/For more informationIf you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc). If you don't find an answer, open a new issue.