`, it is possible to bypass autoescaping and inject content into the DOM.", "datePublished": "2018-05-31T20:00:00Z", "dateModified": "2024-09-16T16:43:50Z", "keywords": "CVE-2016-10547, vulnerability, CVE, security, nunjucks node module, HackerOne", "about": { "@type": "SoftwareApplication", "name": "nunjucks node module", "applicationCategory": "SecurityApplication", "operatingSystem": "All" } }
CVE-2016-10547

CVE-2016-10547

Vendor Hackerone
Product nunjucks node module
Weakness CWE-79 · XSS
Published May 31, 2018
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM.

Key dates

02Disclosure timeline

May 31, 2018 CVE published
September 16, 2024 Record updated