Nunjucks autoescape bypass leads to cross site scripting

Description

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

Recommendation

Update the nunjucks package to the latest compatible version. Followings are version details:

Affected version(s): < 3.2.4
Patched version(s): 3.2.4

References

GHSA-x77j-w7wf-fjmw
bugzilla.mozilla.org
CVE-2023-2142
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Nunjucks autoescape bypass leads to cross site scripting and gives you actionable findings to investigate.

Start a free scan

Related Issues

Vega Expression Language `scale` expression function Cross Site Scripting - vega - CVE-2023-26486
tarteaucitron.js vulnerable to Cross-site Scripting - CVE-2023-3620
Froala Editor Cross-site Scripting vulnerability - CVE-2023-41592
layui vulnerable to cross-site scripting - CVE-2023-3691

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated November 26, 2024