GitHub Advisoryadvisory · npm

GHSA-x77j-w7wf-fjmw Nunjucks autoescape bypass leads to cross site scripting

MEDIUM Published 2023-04-20 Modified 2024-11-26 Official page ↗
Aliases
CVE-2023-2142
Ecosystem
npm
Packages
nunjucks
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-04-20

Affected packages

• npm nunjucks: < 3.2.4 → fixed in 3.2.4

Description

Impact In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash `\` character. Example If the user-controlled parameters were used in the views similar to the following: ``` let testObject = { lang: '{{ lang }}', place: '{{ place }}' }; ``` It is possible to inject XSS payload using the below parameters: ``` https:///?lang=jp\&place=};alert(document.domain)// ``` Patches The issue was patched in version 3.2.4. References • https://bugzilla.mozilla.org/show_bug.cgi?id=1825980

Related

Alias · CVE (1)

  • CVE-2023-2142 In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References