Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2023-2142
6.1
MEDIUMCVSS v3
Severity scale
010
Description
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.
nunjucks
NPMA powerful templating engine with inheritance, asynchronous control, and more (jinja2 inspired)
NPMA powerful templating engine with inheritance, asynchronous control, and more (jinja2 inspired)< 3.2.4OSV
mozilla/nunjucks
GitHubA powerful templating engine with inheritance, asynchronous control, and more (jinja2 inspired)
GitHubA powerful templating engine with inheritance, asynchronous control, and more (jinja2 inspired)< 3.2.4NVD