GitHub Advisoryadvisory · npm
GHSA-w3w8-37jv-2c58 Cross-Site Scripting in mustache
HIGH
Official page ↗
- Aliases
- CVE-2015-8862
- Ecosystem
- npm
- Packages
- mustache
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-06-16
Affected packages
• npm mustache: < 2.2.1 → fixed in 2.2.1
Description
Versions of `mustache` prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.
Example
Template:
``````
Input:
```{ 'foo' : 'test.com onload=alert(1)'}```
Rendered result:
``````
Recommendation
Update to version 2.2.1 or later.
Alternatively, ensure that all attributes in hmustache templates are encapsulated with quotes.
Related
Alias · CVE (1)
- CVE-2015-8862 mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-8862 advisory
- https://github.com/janl/mustache.js/commit/378bcca8a5cfe4058f294a3dbb78e8755e8e0da5 web
- https://github.com/advisories/GHSA-w3w8-37jv-2c58 advisory
- https://github.com/janl/mustache.js package
- https://www.npmjs.com/advisories/62 web
- https://www.tenable.com/security/tns-2016-18 web
- http://www.openwall.com/lists/oss-security/2016/04/20/11 web
- http://www.securityfocus.com/bid/96436 web