# jQuery-UI dependency vulnerabilities in hoops-web-viewer

**URL:** <https://forum.techsoft3d.com/t/jquery-ui-dependency-vulnerabilities-in-hoops-web-viewer/784>\
**Category:** Feedback\
**Tags:** webviewer\
**Created:** [May 16, 2022, 5:45pm UTC](https://forum.techsoft3d.com/t/jquery-ui-dependency-vulnerabilities-in-hoops-web-viewer/784 "2022-05-16T17:45:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ramony](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@ramony](https://forum.techsoft3d.com/u/ramony)\
**Post date:** [May 16, 2022, 5:45pm UTC](https://forum.techsoft3d.com/t/jquery-ui-dependency-vulnerabilities-in-hoops-web-viewer/784/1 "2022-05-16T17:45:41Z")

</div>

I’ve downloaded the HOOPS Communicator 2022 SP1 package and noticed the hoops-web-viewer has a dependency on jQuery-UI 1.11.4. Is the viewer affected by these vulnerabilities?

[CVE-2021-41182](https://nvd.nist.gov/vuln/detail/CVE-2021-41182) MEDIUM (NVD) : jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altFiel…

[CVE-2021-41183](https://nvd.nist.gov/vuln/detail/CVE-2021-41183) MEDIUM (NVD) : jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `\*Te…

CVE-2021-41184 MEDIUM (NVD) : jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` opt.

---

<div class="post-metadata">

**Author:** ![guido](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.techsoft3d.com/guido/32/115_2.png) [@guido](https://forum.techsoft3d.com/u/guido)\
**Post date:** [May 17, 2022, 11:22am UTC](https://forum.techsoft3d.com/t/jquery-ui-dependency-vulnerabilities-in-hoops-web-viewer/784/2 "2022-05-17T11:22:07Z")

</div>

Hi,

thanks for pointing out those potential vulnerabilities. We are using jquery-ui in a very limited way (we are not using the date picker at all for example) and not in any server-side interactions so I think the potential risk is very theoretical.

In any case, this has been brought to the attention of product management and I expect us to upgrade the jQuery-ui version we are using in one of the upcoming releases.

Thanks,  
Guido