{"cve":"CVE-2023-33187","nvd":{"published":"2023-05-26T21:15:20.693","modified":"2026-06-17T06:01:15.880","status":"Modified","description":"Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type=\"text\"` via a javascript \"Show Password\" button. This differs from the expected behavior which always obfuscates `type=\"password\"` inputs. A customer may assume that switching to `type=\"text\"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0.\nThis patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type=\"password\"` continues to be obfuscated.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-319"],"references":["https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc","https://github.com/rrweb-io/rrweb/pull/1184","https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc","https://github.com/rrweb-io/rrweb/pull/1184"],"products":["highlight:highlight"],"source":"nvd","synced_at":"2026-10-19T21:38:24.161619714+00:00"},"epss":{"cve":"CVE-2023-33187","score":0.00285,"percentile":0.21028,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9qpj-qq2r-5mcc","url":"https://osv.dev/vulnerability/GHSA-9qpj-qq2r-5mcc","summary":"html inputs of type password recorded in plaintext when converted to text inputs","modified":"2023-11-08T04:12:39.505858Z","packages":[{"ecosystem":"npm","name":"highlight.run","purl":"pkg:npm/highlight.run","ranges":["<6.0.0"],"fixed":["6.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}