CVE-2023-1767

MEDIUM 5.4CVE-2023-1767 · Published 20/04/2023 · updated 17/06/2026

In short

CVE-2023-1767 is a MEDIUM (CVSS 5.4) vulnerability affecting advisor (snyk).
Chance of exploitation in the next 30 days (EPSS): 0.51%, higher than 43.7% of all vulnerabilities.
Fix: update to 2023-03-28 or later.

Package	Affected versions	Patched versions
advisor snyk	`< 2023-03-28`	`2023-03-28`

Description

The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.

References

support.snyk.io/hc/en-us/articles/10146704933405 · Vendor Advisory
weizman.github.io/2023/04/10/snyk-xss · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free