MediumGHSA-f7ph-p5rv-phw2CVE-2016-10547

Cross-Site Scripting in nunjucks

Published 6 Nov 2018 · Updated 8 Nov 2023

Affected package

Affected: <2.4.3
Fixed in: 2.4.3

Update to the fixed version for your release line, for example:npm install nunjucks@2.4.3

Details

Affected versions of nunjucks do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability.

Proof of Concept

By using an array for the keys in a template var, escaping is bypassed.

name[]=<script>alert(1)</script>

A full PoC is available in the references section.

Recommendation

Update to version 2.4.3 or later.

Is GHSA-f7ph-p5rv-phw2 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected nunjucks, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2016-10547
Linkgithub.com/mozilla/nunjucks/issues/835
Advisorygithub.com/advisories/GHSA-f7ph-p5rv-phw2
Linkgithub.com/matt-/nunjucks_test
Linkwww.npmjs.com/advisories/147

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.