CVE-2023-2142

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-2142
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1825980 Issue Tracking Permissions Required
https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:nunjucks:*:*:*:*:*:*:*:*
History

24 Jun 2025, 16:42

Type Values Removed Values Added
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1825980 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1825980 - Issue Tracking, Permissions Required
References () https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw - () https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw - Vendor Advisory
First Time Mozilla nunjucks
Mozilla
CPE cpe:2.3:a:mozilla:nunjucks:*:*:*:*:*:*:*:*

27 Nov 2024, 17:15

Type Values Removed Values Added
Summary
  • (es) En las versiones de Nunjucks anteriores a la versión 3.2.4, era posible eludir las restricciones que proporciona la función de escape automático. Si hay dos parámetros controlados por el usuario en la misma línea utilizada en las vistas, era posible inyectar payloads de cross-site scripting utilizando el carácter de barra invertida \.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

26 Nov 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-26 12:15

Updated : 2025-06-24 16:42

NVD link : CVE-2023-2142

Mitre link : CVE-2023-2142

CVE.ORG link : CVE-2023-2142

JSON object : View

Products Affected

mozilla

  • nunjucks
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')