GitHub Advisoryadvisory · npm

GHSA-f7ph-p5rv-phw2 Cross-Site Scripting in nunjucks

MEDIUM Published 2018-11-06 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10547
Ecosystem
npm
Packages
nunjucks
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm nunjucks: < 2.4.3 → fixed in 2.4.3

Description

Affected versions of `nunjucks` do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability. Proof of Concept By using an array for the keys in a template var, escaping is bypassed. ```javascript name[]=alert(1) ``` A full PoC is available in the references section. Recommendation Update to version 2.4.3 or later.

Related

Alias · CVE (1)

  • CVE-2016-10547 Nunjucks is a full featured templating engine for JavaScript. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References