CVE-2023-1767 MEDIUM

CVE-2023-1767

Vendor Snyk
Product Snyk Advisor
Weakness CWE-79 · XSS
Published April 20, 2023
Last update February 5, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.

Key dates

02Disclosure timeline

April 20, 2023 CVE published
February 5, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-45361 WordPress 0mk Shortener Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS) CVE-2026-5362 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering CVE-2021-3961 Cross-site Scripting (XSS) - Stored in snipe/snipe-it CVE-2025-25098 WordPress Links in Captions plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability CVE-2024-2922 Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags