---
title: "jQuery-ui-tooltip – XSS Vulnerability Under 1.10.0, Title Attribute"
description: "Impact Area Security       Severity High       Affected Element **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-014**** **(for ServiceNow) **SF-JSL-014 **(for Salesforce) ## Impact Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/jquery-ui-tooltip-xss-vulnerability-under-1-10-0-title-attribute/"
updated: "2025-03-21"
category: Rules
---

# jQuery-ui-tooltip – XSS Vulnerability Under 1.10.0, Title Attribute

Impact Area

Security

 

 

 

           Severity

High

 

 

 

           Affected Element

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-014**** **(for ServiceNow)

**SF-JSL-014 **(for Salesforce)

## Impact

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

## Remediation

Update jQuery to the latest version.

### Time to fix

30 min