CVE-2021-23784

Cross-site Scripting (XSS)

Medium · published November 3, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
69.4
In the wild
Unconfirmed
What it is

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
CVSS v4.0
Not supplied
EPSS
0.01260 · 69.4th percentile
Published
2021-11-03T17:20Z
EPSS history
Timeline
  • 03 NOV 17:20Z
    Cross-site Scripting (XSS)
    cvelistv5