CVE-2023-2142

Nunjucks autoescape bypass leads to cross site scripting

6.1 MediumFix available

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.39%Up 0.3 points since Nov 27, 2024

What each source reports

CVE List Score used 6.1

Nunjucks autoescape bypass leads to cross site scripting

Record: CVE-2023-2142
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2023-1422 6.1

Record: EUVD-2023-1422
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x77j-w7wf-fjmw 5.3

Nunjucks autoescape bypass leads to cross site scripting

Impact

Example

If the user-controlled parameters were used in the views similar to the following:

<script>
let testObject = { lang: '{{ lang }}', place: '{{ place }}' };
</script>

It is possible to inject XSS payload using the below parameters:

https://<application-url>/?lang=jp\&place=};alert(document.domain)//

Patches

The issue was patched in version 3.2.4.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1825980

Record: GHSA-x77j-w7wf-fjmw
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 6.1

Record: CVE-2023-2142
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Nunjucks autoescape bypass leads to cross site scripting

Record: CVE-2023-2142
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-2142 6.1

Record: DEBIAN-CVE-2023-2142
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-x77j-w7wf-fjmw 5.3

Nunjucks autoescape bypass leads to cross site scripting

Impact

Example

If the user-controlled parameters were used in the views similar to the following:

<script>
let testObject = { lang: '{{ lang }}', place: '{{ place }}' };
</script>

It is possible to inject XSS payload using the below parameters:

https://<application-url>/?lang=jp\&place=};alert(document.domain)//

Patches

The issue was patched in version 3.2.4.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1825980

Record: GHSA-x77j-w7wf-fjmw
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-2142 6.1

Record: UBUNTU-CVE-2023-2142
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

mozilla nunjucks

Affected packages

Affected packages
Package	Affected	Fixed
`nunjucks` npm	before 3.2.4	3.2.4
`node-nunjucks` Debian:12	All versions, plus listed versions 3.2.3+dfsg+~cs1.0.1-33.2.4+~cs4.2.7-13.2.4+~cs4.2.7-23.2.4+~cs4.2.7-33.2.4+~cs4.2.7-4	None known
`node-nunjucks` Debian:13	before 3.2.4+~cs4.2.7-1	3.2.4+~cs4.2.7-1
`node-nunjucks` Debian:14	before 3.2.4+~cs4.2.7-1	3.2.4+~cs4.2.7-1
`node-nunjucks` Ubuntu:24.04:LTS	All versions, plus listed versions 3.2.3+dfsg+~cs1.0.1-3	None known
`node-nunjucks` Ubuntu:25.10	All versions, plus listed versions 3.2.3+dfsg+~cs1.0.1-33.2.4+~cs4.2.7-1	None known
`node-nunjucks` Ubuntu:26.10	All versions, plus listed versions 3.2.4+~cs4.2.7-23.2.4+~cs4.2.7-3	None known
`node-nunjucks` Ubuntu:26.04:LTS	All versions, plus listed versions 3.2.4+~cs4.2.7-13.2.4+~cs4.2.7-2	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2142 is a medium vulnerability (CVSS 6.1) in Mozilla Nunjucks, published April 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in nunjucks 3.2.4.

References

Show 6 moreShow less