CVE-2023-2142

A vulnerability exists in Nunjucks versions prior to 3.2.4 where the autoescape functionality can be bypassed. When two user-controlled parameters are used on the same line within views, an attacker can inject cross-site scripting (XSS) payloads by utilizing the backslash () character . Documenta...

CVE-2016-10547

CVE-2016-10547 affects the JavaScript templating engine Nunjucks. Versions ≤ 2.4.2 expose an XSS in autoescape mode: using an array for keys (e.g., name[]=) can bypass escaping and inject content into the DOM. The issue is tied to how template variables are escaped in autoescape mode (noted acros...