Cross-Site Scripting in mustache

Description

Versions of mustache prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.

Recommendation

Update the mustache package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.1
• Patched version(s): 2.2.1

References

• GHSA-w3w8-37jv-2c58
• www.npmjs.com
• www.tenable.com
• www.openwall.com
• www.securityfocus.com
• CVE-2015-8862
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables - CVE-2025-68115
• Cross-Site Scripting (XSS) in jquery - CVE-2015-9251
• Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - CVE-2025-59840
• Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia (GHSA-7f2v-3qq3-vvjf) - CVE-2025-59840

Tags:

npm

mustache