CVE-2023-2142
Nunjucks autoescape bypass leads to cross site scripting
Summary
Nunjucks autoescape bypass leads to cross site scripting
Original description
The description as published by the source.
In Nunjucks versions prior to version 3.2.4, it was
possible to bypass the restrictions which are provided by the autoescape
functionality. If there are two user-controlled parameters on the same
line used in the views, it was possible to inject cross site scripting
payloads using the backslash \ character.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-2142 node-nunjucks
- Ubuntu UBUNTU-CVE-2023-2142 node-nunjucks
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- report bugzilla.mozilla.org