{"id":"CVE-2023-1767","aliases":["EUVD-2023-23978","GHSA-66mg-wfxj-x3xv"],"status":"published","title":"The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th...","description":"The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00513,"percentile":0.43999,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2023-04-20T09:20:05Z","modified":"2026-06-17T05:28:42Z","exploits":[{"source":"pocgithub","id":"weizman/CVE-2023-1767","title":"weizman/CVE-2023-1767","date":"2023-03-15","url":"https://github.com/weizman/CVE-2023-1767"}],"products":[{"vendor":"snyk","product":"advisor"},{"vendor":"snyk","product":"snyk advisor"}],"references":[{"url":"https://support.snyk.io/hc/en-us/articles/10146704933405","tags":["x_transferred","Vendor Advisory"]},{"url":"https://weizman.github.io/2023/04/10/snyk-xss/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1767"},{"url":"https://weizman.github.io/2023/04/10/snyk-xss"},{"url":"https://github.com/advisories/GHSA-66mg-wfxj-x3xv"}],"sources":{"cve":[{"id":"CVE-2023-1767","description":"The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.","status":"published","published":"2023-04-20T09:20:05.667Z","modified":"2025-02-05T16:09:37.635Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-23978","description":"The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.","status":"published","published":"2023-04-20T09:20:05Z","modified":"2025-02-05T16:09:37Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:05.079502Z"}],"ghsa":[{"id":"GHSA-66mg-wfxj-x3xv","title":"The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th...","description":"The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.","status":"published","published":"2023-04-20T12:30:19Z","modified":"2024-04-04T03:36:43Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:16.439649Z"}],"nvd":[{"id":"CVE-2023-1767","description":"The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.","status":"published","published":"2023-04-20T10:15:07.433Z","modified":"2026-06-17T05:28:42.84Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:56.683259Z"}]}}