CVE-2022-31160: jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label

Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio( "refresh" ) on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:

<label>
<input id="test-input">
&lt;img src=x onerror="alert(1)"&gt;
</label>

and calling:

$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );

will turn the initial HTML into:

<label>
<!-- some jQuery UI elements -->
<input id="test-input">
<img src=x onerror="alert(1)">
</label>

and the alert will get executed.