Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

@asyncapi/cli (>=2.5.0 <=4.1.1), @asyncapi/generator (>=2.1.3 <=2.11.0) +3 more potentially affected by unknown CVE via @asyncapi/nunjucks-filters (=2.1.0)

@asyncapi/nunjucks-filters NPM version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/nunjucks-filters and may be impacted: - @asyncapi/cli =2.5.0, =2.1.3, =2.1.4, =0.1.0, =0.1.469 - nestjs-asyncapi =2.0.1 Source cves: unknown CVE...

@asyncapi/cli (>=2.5.0 <=4.1.1), @asyncapi/generator (>=2.1.3 <=2.11.0) +3 more potentially affected by unknown CVE via @asyncapi/nunjucks-filters (=2.1.0)

@asyncapi/nunjucks-filters NPM version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/nunjucks-filters and may be impacted: - @asyncapi/cli =2.5.0, =2.1.3, =2.1.4, =0.1.0, =0.1.469 - nestjs-asyncapi =2.0.1 Source cves: unknown CVE...

EUVD-2025-198696

Malicious code in @asyncapi/nunjucks-filters npm...

MAL-2025-190662 Malicious code in @asyncapi/nunjucks-filters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51137a75fbced2a0515e71df0b97baf386e784c2eb5134c77ed77afdcb48fe34 The package @asyncapi/nunjucks-filters was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191161 Malicious code in ginfuru.better-nunjucks (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c1f105a5bf6daf41b694f7cc339589ac86e57964dd2f761bc04b8ea20fe70ae8 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

EUVD-2018-0746

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2023-2142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two...

CVE-2023-2142

A flaw was found in Nunjucks versions prior to 3.2.4. This vulnerability can allow attackers to inject cross-site scripting XSS payloads via bypassing autoescape functionality by using a backslash \ character when two user-controlled parameters are on the same line in the views...

CVE-2023-2142

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

DEBIAN-CVE-2023-2142

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

CVE-2023-2142

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

UBUNTU-CVE-2023-2142

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

CVE-2023-2142 Nunjucks autoescape bypass leads to cross site scripting

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

CVE-2023-2142 Nunjucks autoescape bypass leads to cross site scripting

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

CVE-2023-2142

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...

Nunjucks 安全漏洞

Nunjucks is a full-featured JavaScript template engine from the Mozilla Foundation. A security vulnerability exists in Nunjucks versions prior to v3.2.4, which stems from the ability to bypass restrictions provided by the auto-escaping feature, allowing an attacker to inject cross-site scripting...

Malicious code in themes-nunjucks-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 06e52365ba2a31a6a5b42155ec0c00fcfe7567016e44255acd479ed14c87ddd4 The OpenSSF Package Analysis project identified 'themes-nunjucks-service' @ 1.2.0 npm as malicious. It is considered malicious because: - The...

Cross-Site Scripting (XSS)

nunjucks is vulnerable to Cross-Site Scripting XSS. The vulnerability is caused by a bypass of the html autoescape functionality when there are two user controlled parameters on the same line of a template, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

3loc (>=0.1.0 <=0.4.0), @accordproject/cicero-cli (>=0.3.4 <=0.20.11-20200413151148) +986 more potentially affected by CVE-2023-2142 via nunjucks (>=0.1.10 <=3.2.3)

nunjucks NPM version =0.1.10, =0.1.0, =0.3.4, =0.3.12-20180525105709, =0.3.4, =0.3.4, =0.11.2-20190326183124, =0.0.5, =0.1.0, =1.1.0-301, =1.3.2, =2.0.0, =0.0.5, =1.2.0, =1.4.0 - @asephermann/capacitor-filechooser =0.0.1 and more Source cves: CVE-2023-2142 Source advisory: OSV:GHSA-X77J-W7WF-FJMW...