Skip to content
OpenAdvisories

Package · npm

nunjucks

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.1
    CVE-2023-2142

    Nunjucks autoescape bypass leads to cross site scripting

    In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site sc…

    Mozilla Nunjucks nunjucks node-nunjucks Debian Ubuntu npm
  • Medium —
    CVE-2016-10547

    Cross-Site Scripting in nunjucks

    Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, s…

    HackerOne nunjucks node module nunjucks npm