Update `croc` to Version 11.2.4 by JLP04 · Pull Request #43 · JLP04/docker-elevation-generator

JLP04 · 2026-08-21T21:11:20Z

Update croc to Version 11.2.4.

github-actions · 2026-08-22T01:31:19Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:31:23Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:c8aa4d31611abd0f69243b585c4d24f4fdf5cec078efc1492257298b072024f7`
vulnerabilities
platform	linux/386
size	9.5 GB
packages	944

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:3398eb66470f493863e9176792c5e27fe61e7bfb7710146f2f403ff8e21c4348`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:31:28Z

Recommended fixes for image (linux/386) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:3398eb66470f493863e9176792c5e27fe61e7bfb7710146f2f403ff8e21c4348
Vulnerabilities
Pushed	2 weeks ago
Size	51 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:32:32Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`d1f8c20ccd06`	`c8aa4d31611a`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/386	linux/386
- size	9.5 GB	9.5 GB (+942 kB)
- packages	942	944 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2133	⚠️ 2029	-104	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

589 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.27.0`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T01:32:58Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:33:02Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:d94ece4e29f446ad720f4498036db1e92423a3da6607cfa43a7751b2c25a6d9b`
vulnerabilities
platform	linux/amd64
size	9.4 GB
packages	948

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:d8f17b92dc7ff10f9c1fdecab0ad21103d1d24aed823c3a0359e4f50adfab3eb`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:33:05Z

Recommended fixes for image (linux/amd64) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:d8f17b92dc7ff10f9c1fdecab0ad21103d1d24aed823c3a0359e4f50adfab3eb
Vulnerabilities
Pushed	2 weeks ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:34:08Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`1b59fad2d28b`	`d94ece4e29f4`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	9.4 GB	9.4 GB (+927 kB)
- packages	946	948 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2136	⚠️ 2029	-107	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

593 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.27.0`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T01:34:35Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:34:38Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:aae897c2e50baa4b277fe51159f71f8bb8bf2f1c7bf7708878ea2786e2c8d22b`
vulnerabilities
platform	linux/arm/v5
size	9.4 GB
packages	932

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:0acc851d7e80aa3f8ecca5638a9b78251deb202586fd7c73f3266947e068d444`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:34:41Z

Recommended fixes for image (linux/arm/v5) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:0acc851d7e80aa3f8ecca5638a9b78251deb202586fd7c73f3266947e068d444
Vulnerabilities
Pushed	2 weeks ago
Size	48 MB
Packages	112
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:35:44Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`b1a4f62fd1a2`	`aae897c2e50b`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/arm	linux/arm
- size	9.4 GB	9.4 GB (+858 kB)
- packages	930	932 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2130	⚠️ 2027	-103	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

585 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.27.0`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T01:36:11Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:36:15Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:f49bc1be90bb1a778f7ade70492b349e939a10b1508557b8a08753289cf73fb1`
vulnerabilities
platform	linux/arm/v7
size	9.4 GB
packages	931

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:6a5f231576d5ab3a5c00ebd57648305941ec7f4f9728650f4c162a2b12b27181`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:36:19Z

Recommended fixes for image (linux/arm/v7) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:6a5f231576d5ab3a5c00ebd57648305941ec7f4f9728650f4c162a2b12b27181
Vulnerabilities
Pushed	2 weeks ago
Size	46 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:37:23Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`58158ab623ca`	`f49bc1be90bb`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/arm	linux/arm
- size	9.4 GB	9.4 GB (+860 kB)
- packages	929	931 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2129	⚠️ 2027	-102	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

585 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.27.0`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T01:37:50Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:37:54Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:9eeaa86029f2d6a6ce1e30c0069e919e26251890e665146e8e5045048f1d6b27`
vulnerabilities
platform	linux/arm64
size	9.4 GB
packages	945

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:5beecfe41dbb22033f1d7da3d51467cc20cdf8b63a309729ee959531f3baef1e`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:37:57Z

Recommended fixes for image (linux/arm64) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:5beecfe41dbb22033f1d7da3d51467cc20cdf8b63a309729ee959531f3baef1e
Vulnerabilities
Pushed	2 weeks ago
Size	50 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:39:01Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`086a4b2e5486`	`9eeaa86029f2`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/arm64	linux/arm64
- size	9.4 GB	9.4 GB (+806 kB)
- packages	943	945 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2135	⚠️ 2029	-106	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

591 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.27.0`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T01:39:30Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:39:34Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:4560739834226b2f53df62498f553c0aa69bdba7fbd7e99257a9d84562ded528`
vulnerabilities
platform	linux/ppc64le
size	9.4 GB
packages	941

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:f7c00a4b691fdfb90bb506ebb177a2b89c3899cab53ea4f548d8a20f1c93aea8`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:39:38Z

Recommended fixes for image (linux/ppc64le) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:f7c00a4b691fdfb90bb506ebb177a2b89c3899cab53ea4f548d8a20f1c93aea8
Vulnerabilities
Pushed	2 weeks ago
Size	53 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:40:45Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`e28561b9d6f3`	`456073983422`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/ppc64le	linux/ppc64le
- size	9.4 GB	9.4 GB (+853 kB)
- packages	939	941 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2135	⚠️ 2029	-106	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

588 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.27.0`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T01:41:13Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2026 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:41:17Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:e3deda8b048c993c12a25c5dbde4661755c30f595e15e53be86850fece9454bc`
vulnerabilities
platform	linux/riscv64
size	9.4 GB
packages	936

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:4f9439c52705c097ee7d929574bb0adf0a6250287a82109857e2e7bb25fba97a`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:41:21Z

Recommended fixes for image (linux/riscv64) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:4f9439c52705c097ee7d929574bb0adf0a6250287a82109857e2e7bb25fba97a
Vulnerabilities
Pushed	2 weeks ago
Size	48 MB
Packages	109
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:42:27Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`337fb6ba0a3f`	`e3deda8b048c`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/riscv64	linux/riscv64
- size	9.4 GB	9.4 GB (+999 kB)
- packages	934	936 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2131	⚠️ 2026	-105	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

585 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.27.0`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T01:42:54Z


Your image	`ghcr.io/jlp04/elevation-generator:test`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T01:42:59Z

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	`sha256:a9cb2f10e899d6212c1317fa815407496923061f7c75ffc9ff8d7c18ccf0c81e`
vulnerabilities
platform	linux/s390x
size	9.4 GB
packages	935

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:5d5b2146f42a36292a206ec87b8e688780d627304f5520cfd50e01502065ea5f`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T01:43:02Z

Recommended fixes for image (linux/s390x) `ghcr.io/jlp04/elevation-generator:test`

Base image is debian:latest

Name	13.6
Digest	sha256:5d5b2146f42a36292a206ec87b8e688780d627304f5520cfd50e01502065ea5f
Vulnerabilities
Pushed	2 weeks ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T01:44:09Z

Overview

Image reference	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`
- digest	`20164eccb79c`	`a9cb2f10e899`
- tag	`latest`	`test`
- provenance	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/41/merge/commit/acbe392b7004d2b3e5fe2ac46ef80dbac1a9a391	https://github.com/JLP04/docker-elevation-generator.git#refs/pull/43/merge/commit/41f27e6d9bdff71dc4991c69c235c5ba39df0dde
- vulnerabilities
- platform	linux/s390x	linux/s390x
- size	9.4 GB	9.4 GB (+876 kB)
- packages	933	935 (+2)
Base Image	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`	`debian:latest` also known as: • `13` • `13.6` • `trixie` • `trixie-20260803`
- vulnerabilities

Policies (2 improved, 0 worsened)

Policy Name	`jlp04/elevation-generator:latest`	`ghcr.io/jlp04/elevation-generator:test`	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2132	⚠️ 2029	-103	Improved
No fixable critical or high vulnerabilities	⚠️ 6	✅	-6	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

Packages and Vulnerabilities (2 package changes and 8 vulnerability changes)

➕ 1 packages added

♾️ 1 packages changed

582 packages unchanged

✔️ 8 vulnerabilities removed

Changes for packages of type generic (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
➕	go		`1.9`

Changes for packages of type golang (1 changes)

	Package	Version `jlp04/elevation-generator:latest`	Version `ghcr.io/jlp04/elevation-generator:test`
♾️	stdlib	`1.26.5`	`1.27.0`

github-actions · 2026-08-22T13:39:26Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:39:32Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:c8aa4d31611abd0f69243b585c4d24f4fdf5cec078efc1492257298b072024f7`
vulnerabilities
platform	linux/386
size	9.5 GB
packages	944

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:3398eb66470f493863e9176792c5e27fe61e7bfb7710146f2f403ff8e21c4348`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:39:37Z

Recommended fixes for image (linux/386) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:3398eb66470f493863e9176792c5e27fe61e7bfb7710146f2f403ff8e21c4348
Vulnerabilities
Pushed	2 weeks ago
Size	51 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T13:40:19Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:40:25Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:d94ece4e29f446ad720f4498036db1e92423a3da6607cfa43a7751b2c25a6d9b`
vulnerabilities
platform	linux/amd64
size	9.4 GB
packages	948

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:d8f17b92dc7ff10f9c1fdecab0ad21103d1d24aed823c3a0359e4f50adfab3eb`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:40:30Z

Recommended fixes for image (linux/amd64) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:d8f17b92dc7ff10f9c1fdecab0ad21103d1d24aed823c3a0359e4f50adfab3eb
Vulnerabilities
Pushed	2 weeks ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T13:41:14Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:41:20Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:aae897c2e50baa4b277fe51159f71f8bb8bf2f1c7bf7708878ea2786e2c8d22b`
vulnerabilities
platform	linux/arm/v5
size	9.4 GB
packages	932

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:0acc851d7e80aa3f8ecca5638a9b78251deb202586fd7c73f3266947e068d444`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:41:25Z

Recommended fixes for image (linux/arm/v5) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:0acc851d7e80aa3f8ecca5638a9b78251deb202586fd7c73f3266947e068d444
Vulnerabilities
Pushed	2 weeks ago
Size	48 MB
Packages	112
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T13:42:06Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:42:13Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:f49bc1be90bb1a778f7ade70492b349e939a10b1508557b8a08753289cf73fb1`
vulnerabilities
platform	linux/arm/v7
size	9.4 GB
packages	931

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:6a5f231576d5ab3a5c00ebd57648305941ec7f4f9728650f4c162a2b12b27181`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:42:17Z

Recommended fixes for image (linux/arm/v7) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:6a5f231576d5ab3a5c00ebd57648305941ec7f4f9728650f4c162a2b12b27181
Vulnerabilities
Pushed	2 weeks ago
Size	46 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T13:43:01Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:43:08Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:9eeaa86029f2d6a6ce1e30c0069e919e26251890e665146e8e5045048f1d6b27`
vulnerabilities
platform	linux/arm64
size	9.4 GB
packages	945

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:5beecfe41dbb22033f1d7da3d51467cc20cdf8b63a309729ee959531f3baef1e`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:43:13Z

Recommended fixes for image (linux/arm64) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:5beecfe41dbb22033f1d7da3d51467cc20cdf8b63a309729ee959531f3baef1e
Vulnerabilities
Pushed	2 weeks ago
Size	50 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T13:43:56Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:44:02Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:4560739834226b2f53df62498f553c0aa69bdba7fbd7e99257a9d84562ded528`
vulnerabilities
platform	linux/ppc64le
size	9.4 GB
packages	941

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:f7c00a4b691fdfb90bb506ebb177a2b89c3899cab53ea4f548d8a20f1c93aea8`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:44:07Z

Recommended fixes for image (linux/ppc64le) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:f7c00a4b691fdfb90bb506ebb177a2b89c3899cab53ea4f548d8a20f1c93aea8
Vulnerabilities
Pushed	2 weeks ago
Size	53 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T13:44:52Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2026 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:44:57Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:e3deda8b048c993c12a25c5dbde4661755c30f595e15e53be86850fece9454bc`
vulnerabilities
platform	linux/riscv64
size	9.4 GB
packages	936

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:4f9439c52705c097ee7d929574bb0adf0a6250287a82109857e2e7bb25fba97a`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:45:03Z

Recommended fixes for image (linux/riscv64) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:4f9439c52705c097ee7d929574bb0adf0a6250287a82109857e2e7bb25fba97a
Vulnerabilities
Pushed	2 weeks ago
Size	48 MB
Packages	109
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2026-08-22T13:45:46Z


Your image	`jlp04/elevation-generator:latest`
Current base image	`debian:latest`

Policy Status
(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

github-actions · 2026-08-22T13:45:52Z

🔍 Vulnerabilities of `jlp04/elevation-generator:latest`

📦 Image Reference jlp04/elevation-generator:latest

digest	`sha256:a9cb2f10e899d6212c1317fa815407496923061f7c75ffc9ff8d7c18ccf0c81e`
vulnerabilities
platform	linux/s390x
size	9.4 GB
packages	935

📦 Base Image debian:13

also known as	`13.6` `latest` `trixie` `trixie-20260803`
digest	`sha256:5d5b2146f42a36292a206ec87b8e688780d627304f5520cfd50e01502065ea5f`
vulnerabilities

jquery-ui 1.11.2 (npm)

pkg:npm/jquery-ui@1.11.2

# Dockerfile (268:268)
COPY --from=build /tmp/install /flightgear/script/dnc-managed/install

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`40.768%`
EPSS Percentile	`99th percentile`

Description

Impact

Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
will call the doEvilThing() function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the of option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`8.533%`
EPSS Percentile	`95th percentile`

Description

Impact

Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
will call doEvilThing with 6 different parameters coming from all *Text options.

Patches

The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML.

Workarounds

A workaround is to not accept the value of the *Text options from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.0`
Fixed version	`1.13.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`
EPSS Score	`39.361%`
EPSS Percentile	`98th percentile`

Description

Impact

Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
will call the doEvilThing function.

Patches

The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector.

Workarounds

A workaround is to not accept the value of the altField option from untrusted sources.

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.13.2`
Fixed version	`1.13.2`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`2.475%`
EPSS Percentile	`83rd percentile`

Description

Impact

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
and calling:
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
will turn the initial HTML into:
<label>
	
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
and the alert will get executed.

Patches

The bug has been patched in jQuery UI 1.13.2.

Workarounds

To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span:
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
References

https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected range	`<1.12.0`
Fixed version	`1.12.0`
CVSS Score	`6.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
EPSS Score	`22.580%`
EPSS Percentile	`98th percentile`

Description

Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<=1.11.4`
Fixed version	`1.12.0`

Description

jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

github-actions · 2026-08-22T13:45:58Z

Recommended fixes for image (linux/s390x) `jlp04/elevation-generator:latest`

Base image is debian:latest

Name	13.6
Digest	sha256:5d5b2146f42a36292a206ec87b8e688780d627304f5520cfd50e01502065ea5f
Vulnerabilities
Pushed	2 weeks ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260803

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

Update croc to Version 11.2.4

4559943

JLP04 added the pr-pull This PR is ready to be merged, and the changes within are ready to be promoted to the `latest` tag label Aug 22, 2026

github-actions Bot merged commit 788ef50 into main Aug 22, 2026
16 of 17 checks passed

github-actions Bot deleted the croc-11.2.4 branch August 22, 2026 13:46

Conversation

JLP04 commented Aug 21, 2026

Uh oh!

github-actions Bot commented Aug 22, 2026

Uh oh!

github-actions Bot commented Aug 22, 2026

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

References

For more information

Recommendation

Uh oh!

github-actions Bot commented Aug 22, 2026

Recommended fixes for image (linux/386) ghcr.io/jlp04/elevation-generator:test

Refresh base image

Change base image

Uh oh!

github-actions Bot commented Aug 22, 2026

Overview

Uh oh!

github-actions Bot commented Aug 22, 2026

Uh oh!

github-actions Bot commented Aug 22, 2026

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

References

For more information

Recommendation

Uh oh!

github-actions Bot commented Aug 22, 2026

Recommended fixes for image (linux/amd64) ghcr.io/jlp04/elevation-generator:test

Refresh base image

Change base image

Uh oh!

github-actions Bot commented Aug 22, 2026

Overview

Uh oh!

github-actions Bot commented Aug 22, 2026

Uh oh!

github-actions Bot commented Aug 22, 2026

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

For more information

Impact

Patches

Workarounds

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

Recommended fixes for image (linux/386) `ghcr.io/jlp04/elevation-generator:test`

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

Recommended fixes for image (linux/amd64) `ghcr.io/jlp04/elevation-generator:test`

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

Recommended fixes for image (linux/arm/v5) `ghcr.io/jlp04/elevation-generator:test`

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`

Recommended fixes for image (linux/arm/v7) `ghcr.io/jlp04/elevation-generator:test`

🔍 Vulnerabilities of `ghcr.io/jlp04/elevation-generator:test`