Most recent entries from all

EUVD-2026-164575

fkie_cve-2016-10547

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM.

GHSA-f7ph-p5rv-phw2 — Cross-Site Scripting in nunjucks

Affected: npm: nunjucks

Affected versions of `nunjucks` do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability.

## Proof of Concept

By using an array for the keys in a template var, escaping is bypassed. ```javascript name[]=<script>alert(1)</script> ```

A full PoC is available in the references section.

## Recommendation

Update to version 2.4.3 or later.

Most recent entries from all

EUVD-2026-164575

fkie_cve-2016-10547

GHSA-f7ph-p5rv-phw2 — Cross-Site Scripting in nunjucks

gsd-2016-10547