jquery-validate dependency out of date in 8.x for Microsoft.AspNetCore.Identity.UI

[rhysgodfrey]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

The latest 8.x release of Microsoft.AspNetCore.Identity.UI (8.0.11) has a dependecy on jquery-validate 1.19.5.

Newer versions of jquery-validate have a security fix (jquery-validation/jquery-validation#2462).

The 9.x version has been updated to have the latest version #57863.

Is a backport of these updates to 8.x planned?

Expected Behavior

No response

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

No response

Anything else?

No response

[MackinnonBuck]

Thanks for reaching out, @rhysgodfrey.

Is there a CVE for this? I wasn't able to find one. If it's high severity, we're likely to backport the dependency update.

[rhysgodfrey]

Hi @MackinnonBuck ,

I can't find a CVE either, we've checked with our pen testers who also don't have a CVE for this, but one of their tools flagged it as an issue as the version in use has a potential XSS vulnerability in the showLabel method, which was fixed in version 1.20.0. The only info we have is the issue in the jquery-validate repository (jquery-validation/jquery-validation#2462).