CVE-2023-2142

What it actually does

The flaw permits unsanitized user input to be rendered directly into HTML output by the nunjucks template engine, bypassing built-in escaping and allowing arbitrary script execution in the context of the victim's browser.

Why it matters to the business

Organizations using older nunjucks versions face risk of client-side attacks that could steal session tokens, redirect users, or deface web interfaces, though the vulnerability's age and low exploitation probability reduce immediate operational disruption.

How an attack unfolds

An attacker supplies crafted input containing HTML and script tags to an application that passes the data into nunjucks templates without proper escaping; when the page renders for another user, the injected code executes in that user's browser session.

How to fix it

Upgrade mozilla/nunjucks to the version containing commit 86a77f49da4779d55414d8337e1a4d7ec7582da5 or later; enable autoescaping on all templates and review custom filters for unsafe HTML output.

How to confirm the fix worked

Confirm nunjucks version is at or beyond the fixed commit, run automated XSS scanners against affected templates, and manually test input fields with known payload vectors to verify escaping behavior.

Typical attack path

1. Identify application endpoints that accept input later rendered by nunjucks templates
2. Craft payload containing script or event-handler tags that bypasses existing sanitization
3. Submit payload via form, query parameter, or API request
4. Wait for or lure a victim user to view the rendered page
5. Execute arbitrary JavaScript in the victim's browser context

How to detect it

Review web application logs and template rendering traces for unexpected script tags or event handlers in rendered output; examine access logs for repeated requests containing common XSS payload patterns to nunjucks-dependent endpoints.

What your security team should do

• Prioritize upgrade of nunjucks in all applications to the fixed commit
• Audit template usage to ensure autoescape is enabled by default
• Add input validation and output encoding layers as defense-in-depth
• Monitor dependency scanners for any remaining nunjucks instances below the fixed version