UBUNTU-CVE-2023-2142

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2023-2142
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-2142.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-2142
Related
Published
2024-11-26T12:15:00Z
Modified
2025-01-13T10:24:00Z
Summary
[none]
Details

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

References

Affected packages

Ubuntu:24.10 / node-nunjucks

Package

Name
node-nunjucks
Purl
pkg:deb/ubuntu/node-nunjucks@3.2.3+dfsg+~cs1.0.1-3?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.2.3+dfsg+~cs1.0.1-3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / node-nunjucks

Package

Name
node-nunjucks
Purl
pkg:deb/ubuntu/node-nunjucks@3.2.3+dfsg+~cs1.0.1-3?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.2.3+dfsg+~cs1.0.1-3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}