CVE-2023-2142

Published November 26th, 2024

View on NVD ↗

CVSS v3

6.1

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

mozilla/nunjucks

A powerful templating engine with inheritance, asynchronous control, and more (jinja2 inspired)

GitHub

8.96K