Bump github/codeql-action/upload-sarif from 4.37.8 to 4.37.9

[dependabot]

Bumps github/codeql-action/upload-sarif from 4.37.8 to 4.37.9.

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits

• cdf488f Merge pull request #4107 from github/update-v4.37.9-920ba7cd1
• 7243f38 Update changelog for v4.37.9
• 920ba7c Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4
• ecfa6e1 Add changelog note
• adcdf4a Update default bundle to codeql-bundle-v2.26.4
• 486fec2 Merge pull request #4099 from github/update-supported-enterprise-server-versions
• 134624c Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...
• ff43db8 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde
• 4605e03 Rebuild
• 099c869 Update changelog and version after v4.37.8
• Additional commits viewable in compare view

[JLP04]

Approved.

[JLP04]

@dependabot rebase

[github-actions]

Your image	ghcr.io/jlp04/elevation-generator:test
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	sha256:1c68ba29d841d14fae21b78bbd752c7f019a46ee686e4c9474f363ae2b11d2ab
vulnerabilities
platform	linux/386
size	9.5 GB
packages	1000

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:c6a693e838695b155a626e829d8463d634f33f6f61dcaa3b733f80f0d566cffd
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/386) ghcr.io/jlp04/elevation-generator:test

Base image is debian:latest

Name	13.6
Digest	sha256:c6a693e838695b155a626e829d8463d634f33f6f61dcaa3b733f80f0d566cffd
Vulnerabilities
Pushed	1 week ago
Size	51 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Overview

Image reference	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test
- digest	45956c9d7f15	1c68ba29d841
- tag	latest	test
- provenance	https://github.com/JLP04/docker-elevation-generator.git#021eeed51e90a785ec14cf9d624bf79d35d08775/commit/021eeed51e90a785ec14cf9d624bf79d35d08775	https://github.com/JLP04/docker-elevation-generator.git#fb2023986a59875a71bb00bad477ac1b9426de25/commit/fb2023986a59875a71bb00bad477ac1b9426de25
- vulnerabilities
- platform	linux/386	linux/386
- size	9.5 GB	9.5 GB (+1.3 kB)
- packages	1000	1000
Base Image	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824
- vulnerabilities

Policies (0 improved, 0 worsened)

Health score: jlp04/elevation-generator:latest B (89%) → ghcr.io/jlp04/elevation-generator:test B (89%)

Policy Name	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2029	⚠️ 2029		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

[github-actions]

Your image	ghcr.io/jlp04/elevation-generator:test
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	sha256:5b315e62a9997f5d142fa067e1f806d2853928c53db8e8f996cf1bdc12b997c9
vulnerabilities
platform	linux/amd64
size	9.5 GB
packages	1004

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:6788062a1b42ac281f053ac876170b79a3eaed5d61383b8ed7eaca6c6965f3b1
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/amd64) ghcr.io/jlp04/elevation-generator:test

Base image is debian:latest

Name	13.6
Digest	sha256:6788062a1b42ac281f053ac876170b79a3eaed5d61383b8ed7eaca6c6965f3b1
Vulnerabilities
Pushed	1 week ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Overview

Image reference	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test
- digest	0aa170f4c150	5b315e62a999
- tag	latest	test
- provenance	https://github.com/JLP04/docker-elevation-generator.git#021eeed51e90a785ec14cf9d624bf79d35d08775/commit/021eeed51e90a785ec14cf9d624bf79d35d08775	https://github.com/JLP04/docker-elevation-generator.git#fb2023986a59875a71bb00bad477ac1b9426de25/commit/fb2023986a59875a71bb00bad477ac1b9426de25
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	9.5 GB	9.5 GB (-898 B)
- packages	1004	1004
Base Image	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824
- vulnerabilities

Policies (0 improved, 0 worsened)

Health score: jlp04/elevation-generator:latest B (89%) → ghcr.io/jlp04/elevation-generator:test B (89%)

Policy Name	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2029	⚠️ 2029		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

[github-actions]

Your image	ghcr.io/jlp04/elevation-generator:test
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	sha256:757fe49e42276af0b6dcd42fda7b9a0c1b7ffce4a157e6990cf29e2d27b0f883
vulnerabilities
platform	linux/arm/v5
size	9.4 GB
packages	988

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:364aca61298b11098e3e969d9a5ccb465fca057410132d2182a38076d652f873
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/arm/v5) ghcr.io/jlp04/elevation-generator:test

Base image is debian:latest

Name	13.6
Digest	sha256:364aca61298b11098e3e969d9a5ccb465fca057410132d2182a38076d652f873
Vulnerabilities
Pushed	1 week ago
Size	48 MB
Packages	112
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Overview

Image reference	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test
- digest	f3b3e644f0d2	757fe49e4227
- tag	latest	test
- provenance	https://github.com/JLP04/docker-elevation-generator.git#021eeed51e90a785ec14cf9d624bf79d35d08775/commit/021eeed51e90a785ec14cf9d624bf79d35d08775	https://github.com/JLP04/docker-elevation-generator.git#fb2023986a59875a71bb00bad477ac1b9426de25/commit/fb2023986a59875a71bb00bad477ac1b9426de25
- vulnerabilities
- platform	linux/arm	linux/arm
- size	9.4 GB	9.4 GB (+15 kB)
- packages	988	988
Base Image	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824
- vulnerabilities

Policies (0 improved, 0 worsened)

Health score: jlp04/elevation-generator:latest B (89%) → ghcr.io/jlp04/elevation-generator:test B (89%)

Policy Name	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2027	⚠️ 2027		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

[github-actions]

Your image	ghcr.io/jlp04/elevation-generator:test
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	sha256:c53c11ab8428fdc9bfa2ff79703a950ea42e1e56e7079d5d21bed783b5d96542
vulnerabilities
platform	linux/arm/v7
size	9.4 GB
packages	987

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:67889230b31fc163ae252f82b95098e5490996e1e1d5367106fc0b34a79618b0
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/arm/v7) ghcr.io/jlp04/elevation-generator:test

Base image is debian:latest

Name	13.6
Digest	sha256:67889230b31fc163ae252f82b95098e5490996e1e1d5367106fc0b34a79618b0
Vulnerabilities
Pushed	1 week ago
Size	46 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Overview

Image reference	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test
- digest	6433213c387c	c53c11ab8428
- tag	latest	test
- provenance	https://github.com/JLP04/docker-elevation-generator.git#021eeed51e90a785ec14cf9d624bf79d35d08775/commit/021eeed51e90a785ec14cf9d624bf79d35d08775	https://github.com/JLP04/docker-elevation-generator.git#fb2023986a59875a71bb00bad477ac1b9426de25/commit/fb2023986a59875a71bb00bad477ac1b9426de25
- vulnerabilities
- platform	linux/arm	linux/arm
- size	9.4 GB	9.4 GB (+1.6 kB)
- packages	987	987
Base Image	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824
- vulnerabilities

Policies (0 improved, 0 worsened)

Health score: jlp04/elevation-generator:latest B (89%) → ghcr.io/jlp04/elevation-generator:test B (89%)

Policy Name	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2027	⚠️ 2027		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

[github-actions]

Your image	ghcr.io/jlp04/elevation-generator:test
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	sha256:e44f777f69e080e7761d7978eb99566e85f5e51dfe32843111f628f319c5a7a4
vulnerabilities
platform	linux/arm64
size	9.4 GB
packages	1001

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:0aa0908407cce3da2a90c1d80acc6ca5ca57401ed63eecfa8149b7ba3cc40829
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/arm64) ghcr.io/jlp04/elevation-generator:test

Base image is debian:latest

Name	13.6
Digest	sha256:0aa0908407cce3da2a90c1d80acc6ca5ca57401ed63eecfa8149b7ba3cc40829
Vulnerabilities
Pushed	1 week ago
Size	50 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

🔍 Vulnerabilities of ghcr.io/jlp04/elevation-generator:test

📦 Image Reference ghcr.io/jlp04/elevation-generator:test

digest	sha256:10bb5e8631de2d78743fcfa83ebbc861fb8aa931780fec3edd9ed3c12d22b267
vulnerabilities
platform	linux/s390x
size	9.5 GB
packages	991

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:e2055a9f29c4d1255594863b5a955325c9f02aea68be9264c06bdba25ca8cfc4
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/s390x) ghcr.io/jlp04/elevation-generator:test

Base image is debian:latest

Name	13.6
Digest	sha256:e2055a9f29c4d1255594863b5a955325c9f02aea68be9264c06bdba25ca8cfc4
Vulnerabilities
Pushed	1 week ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Overview

Image reference	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test
- digest	776495b3e855	10bb5e8631de
- tag	latest	test
- provenance	https://github.com/JLP04/docker-elevation-generator.git#021eeed51e90a785ec14cf9d624bf79d35d08775/commit/021eeed51e90a785ec14cf9d624bf79d35d08775	https://github.com/JLP04/docker-elevation-generator.git#fb2023986a59875a71bb00bad477ac1b9426de25/commit/fb2023986a59875a71bb00bad477ac1b9426de25
- vulnerabilities
- platform	linux/s390x	linux/s390x
- size	9.5 GB	9.5 GB (+639 B)
- packages	991	991
Base Image	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824	debian:latest also known as: • 13 • 13.6 • trixie • trixie-20260824
- vulnerabilities

Policies (0 improved, 0 worsened)

Health score: jlp04/elevation-generator:latest B (89%) → ghcr.io/jlp04/elevation-generator:test B (89%)

Policy Name	jlp04/elevation-generator:latest	ghcr.io/jlp04/elevation-generator:test	Change	Standing
Default non-root user	⚠️	⚠️		No Change
No copyleft licenses	⚠️ 2029	⚠️ 2029		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:1c68ba29d841d14fae21b78bbd752c7f019a46ee686e4c9474f363ae2b11d2ab
vulnerabilities
platform	linux/386
size	9.5 GB
packages	1000

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:c6a693e838695b155a626e829d8463d634f33f6f61dcaa3b733f80f0d566cffd
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/386) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:c6a693e838695b155a626e829d8463d634f33f6f61dcaa3b733f80f0d566cffd
Vulnerabilities
Pushed	1 week ago
Size	51 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:5b315e62a9997f5d142fa067e1f806d2853928c53db8e8f996cf1bdc12b997c9
vulnerabilities
platform	linux/amd64
size	9.5 GB
packages	1004

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:6788062a1b42ac281f053ac876170b79a3eaed5d61383b8ed7eaca6c6965f3b1
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/amd64) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:6788062a1b42ac281f053ac876170b79a3eaed5d61383b8ed7eaca6c6965f3b1
Vulnerabilities
Pushed	1 week ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:757fe49e42276af0b6dcd42fda7b9a0c1b7ffce4a157e6990cf29e2d27b0f883
vulnerabilities
platform	linux/arm/v5
size	9.4 GB
packages	988

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:364aca61298b11098e3e969d9a5ccb465fca057410132d2182a38076d652f873
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/arm/v5) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:364aca61298b11098e3e969d9a5ccb465fca057410132d2182a38076d652f873
Vulnerabilities
Pushed	1 week ago
Size	48 MB
Packages	112
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2027 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:c53c11ab8428fdc9bfa2ff79703a950ea42e1e56e7079d5d21bed783b5d96542
vulnerabilities
platform	linux/arm/v7
size	9.4 GB
packages	987

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:67889230b31fc163ae252f82b95098e5490996e1e1d5367106fc0b34a79618b0
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/arm/v7) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:67889230b31fc163ae252f82b95098e5490996e1e1d5367106fc0b34a79618b0
Vulnerabilities
Pushed	1 week ago
Size	46 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:e44f777f69e080e7761d7978eb99566e85f5e51dfe32843111f628f319c5a7a4
vulnerabilities
platform	linux/arm64
size	9.4 GB
packages	1001

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:0aa0908407cce3da2a90c1d80acc6ca5ca57401ed63eecfa8149b7ba3cc40829
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/arm64) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:0aa0908407cce3da2a90c1d80acc6ca5ca57401ed63eecfa8149b7ba3cc40829
Vulnerabilities
Pushed	1 week ago
Size	50 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:2fa1cca88e88b3ef26e9fbd92ee5b60a9cff41f41944a10f42a0b8d0f4200108
vulnerabilities
platform	linux/ppc64le
size	9.5 GB
packages	997

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:1319f7d87e5a1a0e1928cd279245ac53ca18d308fa48e413a5d9e2a9a8d6d56f
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/ppc64le) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:1319f7d87e5a1a0e1928cd279245ac53ca18d308fa48e413a5d9e2a9a8d6d56f
Vulnerabilities
Pushed	1 week ago
Size	53 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2026 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:422361b5f4444195ec008be575b04bcd62af14d128aad90be21c96334347f36d
vulnerabilities
platform	linux/riscv64
size	9.4 GB
packages	992

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:25bcf4a1343c235ea5b5ab90bf899d9fcf5c11239abda9ae5cdcc82de2e6c694
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/riscv64) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:25bcf4a1343c235ea5b5ab90bf899d9fcf5c11239abda9ae5cdcc82de2e6c694
Vulnerabilities
Pushed	1 week ago
Size	48 MB
Packages	109
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

[github-actions]

Your image	jlp04/elevation-generator:latest
Current base image	debian:latest

Policy Status

(5/7 policies met)

Status	Policy	Results
⚠️	Image runs as the root user
⚠️	Copyleft licensed packages found	2029 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
✅	No outdated base images
✅	No unapproved base images	0 deviations
✅	Supply chain attestations	0 deviations

[github-actions]

🔍 Vulnerabilities of jlp04/elevation-generator:latest

📦 Image Reference jlp04/elevation-generator:latest

digest	sha256:10bb5e8631de2d78743fcfa83ebbc861fb8aa931780fec3edd9ed3c12d22b267
vulnerabilities
platform	linux/s390x
size	9.5 GB
packages	991

📦 Base Image debian:13

also known as	13.6 latest trixie trixie-20260824
digest	sha256:e2055a9f29c4d1255594863b5a955325c9f02aea68be9264c06bdba25ca8cfc4
vulnerabilities

jquery-ui 1.11.2 (npm) pkg:npm/jquery-ui@1.11.2 # Dockerfile (268:268) COPY --from=build /tmp/install /flightgear/script/dnc-managed/install Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 40.768% EPSS Percentile 99th percentile Description Impact Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code: $( "#element" ).position( { my: "left top", at: "right bottom", of: "<img onerror='doEvilThing()' src='/404' />", collision: "none" } ); will call the doEvilThing() function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the of option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 8.533% EPSS Percentile 95th percentile Description Impact Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { showButtonPanel: true, showOn: "both", closeText: "<script>doEvilThing( 'closeText XSS' )</script>", currentText: "<script>doEvilThing( 'currentText XSS' )</script>", prevText: "<script>doEvilThing( 'prevText XSS' )</script>", nextText: "<script>doEvilThing( 'nextText XSS' )</script>", buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>", appendText: "<script>doEvilThing( 'appendText XSS' )</script>", } ); will call doEvilThing with 6 different parameters coming from all *Text options. Patches The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. Workarounds A workaround is to not accept the value of the *Text options from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.0 Fixed version 1.13.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N EPSS Score 39.361% EPSS Percentile 98th percentile Description Impact Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); will call the doEvilThing function. Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. Workarounds A workaround is to not accept the value of the altField option from untrusted sources. For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.13.2 Fixed version 1.13.2 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 2.475% EPSS Percentile 83rd percentile Description Impact Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code. For example, starting with the following initial secure HTML: <label> <input id="test-input"> &lt;img src=x onerror="alert(1)"&gt; </label> and calling: $( "#test-input" ).checkboxradio(); $( "#test-input" ).checkboxradio( "refresh" ); will turn the initial HTML into: <label> <!-- some jQuery UI elements --> <input id="test-input"> <img src=x onerror="alert(1)"> </label> and the alert will get executed. Patches The bug has been patched in jQuery UI 1.13.2. Workarounds To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the label in a span: <label> <input id="test-input"> <span>&lt;img src=x onerror="alert(1)"&gt;</span> </label> References https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ For more information If you have any questions or comments about this advisory, search for a relevant issue in the jQuery UI repo. If you don't find an answer, open a new issue. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <1.12.0 Fixed version 1.12.0 CVSS Score 6.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N EPSS Score 22.580% EPSS Percentile 98th percentile Description Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in the dialog function. jQuery-UI is a library for manipulating UI elements via jQuery. Version 1.11.4 has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector. Recommendation Upgrade to jQuery-UI 1.12.0 or later. OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <=1.11.4 Fixed version 1.12.0 Description jQuery-UI has a cross site scripting (XSS) vulnerability in the closeText parameter of the dialog function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

[github-actions]

Recommended fixes for image (linux/s390x) jlp04/elevation-generator:latest

Base image is debian:latest

Name	13.6
Digest	sha256:e2055a9f29c4d1255594863b5a955325c9f02aea68be9264c06bdba25ca8cfc4
Vulnerabilities
Pushed	1 week ago
Size	49 MB
Packages	111
OS	13.6

The base image is also available under the supported tag(s): 13, 13.6, trixie, trixie-20260824

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.