CVE-2023-2142

6.1 mediumEPSS 0.4%

Medium (6.1) in mozilla nunjucks. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in nunjucks 3.2.4.

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-11-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:nunjucks

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-x77j-w7wf-fjmw	npm	nunjucks	<3.2.4	3.2.4

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1825980
https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw

Check your stack JSON