Cross-site Scripting in teddy

MEDIUM 6.1CVE-2021-23447 · GHSA-5f38-9jw2-6r6h · SNYK-JS-TEDDY-1579557 · Published 07/10/2021 · updated 17/06/2026

In short

CVE-2021-23447 is a MEDIUM (CVSS 6.1) vulnerability affecting teddy (teddy project), teddy.
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.6% of all vulnerabilities.
Fix: update to 0.5.9 or later.

Package	Affected versions	Patched versions
teddy teddy_project	`< 0.5.9`	`0.5.9`
teddy npm	`< 0.5.9`	`0.5.9`

Description

Teddy is a readable and easy to learn templating language. This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).

NVD description

This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).

References

nvd.nist.gov/vuln/detail/CVE-2021-23447 · ADVISORY
rooseveltframework/teddy#518 · WEB
rooseveltframework/teddy commit 64c5567 · WEB
rooseveltframework/teddy · PACKAGE
rooseveltframework/teddy release 0.5.9 · WEB
snyk.io/vuln/SNYK-JS-TEDDY-1579557 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free