CVE-2023-2142

Summary

CVE-2023-2142 is a vulnerability affecting Nunjucks versions below 3.2.4. This issue permits bypassing the autoescape functionality, allowing attackers to inject cross-site scripting (XSS) payloads. The vulnerability can be exploited when two user-controlled parameters appear on the same line within views. The backslash character (\) is used to bypass Nunjucks' restrictions, enabling the malicious code injection.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.