XSS in HackerOne Nunjucks Node Module
CVE-2016-10547
Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.014 (72.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- HackerOne Nunjucks Node Module — versions <=2.4.2
- Mozilla Nunjucks
Weakness classification (CWE)
References
- github.com/mozilla/nunjucks/issues/835 (Exploit, Third Party Advisory)
- nodesecurity.io/advisories/147 (Exploit, Third Party Advisory)
- github.com/matt-/nunjucks_test (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2016-10547?
- CVE-2016-10547 is a medium-severity vulnerability in HackerOne Nunjucks Node Module, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2018-05-31.
- How severe is CVE-2016-10547?
- Medium severity. CVSS v3 base score is 6.1 out of 10.