Vulnerability · Published Nov 26, 2024 · Assigned by mozilla
CVE-2023-2142Nunjucks autoescape bypass leads to cross site scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in Nunjucks from Mozilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.4%top 67.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-nunjucks | no fix listed | DEBIAN-CVE-2023-2142 |
| Debian:13 | node-nunjucks | 3.2.4+~cs4.2.7-1 | DEBIAN-CVE-2023-2142 |
| Debian:14 | node-nunjucks | 3.2.4+~cs4.2.7-1 | DEBIAN-CVE-2023-2142 |
| Ubuntu:24.04:LTS | node-nunjucks | no fix listed | UBUNTU-CVE-2023-2142 |
| Ubuntu:25.10 | node-nunjucks | no fix listed | UBUNTU-CVE-2023-2142 |
| Ubuntu:26.04:LTS | node-nunjucks | no fix listed | UBUNTU-CVE-2023-2142 |
| Ubuntu:26.10 | node-nunjucks | no fix listed | UBUNTU-CVE-2023-2142 |
| npm | nunjucks | 3.2.4 | GHSA-x77j-w7wf-fjmw |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N