CVE-2023-2142: Nunjucks autoescape bypass leads to cross site scripting
(updated )
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.
References
- bugzilla.mozilla.org/show_bug.cgi?id=1825980
- github.com/advisories/GHSA-x77j-w7wf-fjmw
- github.com/mozilla/nunjucks
- github.com/mozilla/nunjucks/commit/ec16d210e7e13f862eccdb0bc9af9f60ff6749d6
- github.com/mozilla/nunjucks/pull/1437
- github.com/mozilla/nunjucks/releases/tag/v3.2.4
- github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw
- nvd.nist.gov/vuln/detail/CVE-2023-2142
Code Behaviors & Features
Detect and mitigate CVE-2023-2142 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →