CVE-2023-2591
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Record
CVE-2023-2591- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-1602
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Record
EUVD-2023-1602- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-prj5-2g2p-x2mw
teampass vulnerable to code injection
In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. The issue is fixed in version 3.0.7.
- Record
GHSA-prj5-2g2p-x2mw- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
NVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Record
CVE-2023-2591- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
- Record
CVE-2023-2591- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-prj5-2g2p-x2mw
teampass vulnerable to code injection
In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. The issue is fixed in version 3.0.7.
- Record
GHSA-prj5-2g2p-x2mw- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nilsteampassnet/teampassPackagist |
before 3.0.7 | 3.0.7 |
nilsteampassnet/teampassPackagist |
before 3.0.7, plus listed versions 2.1.212.1.262.1.273.0.03.0.0.103.0.0.11 |
3.0.7 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mnqazi/CVE-2023-2591 | 2023-05-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2591 is a high vulnerability (CVSS 7.1) in Nilsteampassnet Nilsteampassnet/teampass, published May 9, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in nilsteampassnet/teampass 3.0.7.
References
huntr.dev/bounties/705f79f4-f5e3-41d7-82a5-f00441cd984b
github.com/nilsteampassnet/teampass/commit/57a977c6323656e5dc06ab5c227e75c3465a1a4a
nvd.nist.gov/vuln/detail/CVE-2023-2591