| Package | Affected versions | Patched versions |
|---|---|---|
| nunjucks | < 3.2.4 | 3.2.4 |
| nunjucks | < 3.2.4 | 3.2.4 |
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.
If the user-controlled parameters were used in the views similar to the following:
<script>
let testObject = { lang: '{{ lang }}', place: '{{ place }}' };
</script>
It is possible to inject XSS payload using the below parameters:
https://<application-url>/?lang=jp\&place=};alert(document.domain)//
The issue was patched in version 3.2.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free