CVE-2023-2142CWE-79

Nunjucks autoescape bypass leads to cross site scripting

Medium · published November 26, 2024

CVSS v3.1
6.1
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

In Nunjucks versions prior to version 3.2.4, it was

possible to bypass the restrictions which are provided by the autoescape

functionality. If there are two user-controlled parameters on the same

line used in the views, it was possible to inject cross site scripting

payloads using the backslash \ character.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-26T11:24Z
EPSS history
Timeline
  • 26 NOV 11:24Z
    Nunjucks autoescape bypass leads to cross site scripting
    cvelistv5