https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T17:33:44.864085+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-164575 EUVD-2026-164575 2026-10-16T17:33:44.935031+00:00 EUVD-2026-164575 https://cve.radiocsirt.org/vuln/fkie_cve-2016-10547 fkie_cve-2016-10547 2026-10-16T17:33:44.935067+00:00

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM.

 https://cve.radiocsirt.org/vuln/ghsa-f7ph-p5rv-phw2 GHSA-f7ph-p5rv-phw2 — Cross-Site Scripting in nunjucks 2026-10-16T17:33:44.935100+00:00

Affected: npm: nunjucks

Affected versions of `nunjucks` do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability.

## Proof of Concept

By using an array for the keys in a template var, escaping is bypassed. ```javascript name[]=<script>alert(1)</script> ```

A full PoC is available in the references section.

## Recommendation

Update to version 2.4.3 or later.

 https://cve.radiocsirt.org/vuln/gsd-2016-10547 gsd-2016-10547 2026-10-16T17:33:44.935131+00:00 gsd-2016-10547