mustache@0.3.1-dev vulnerabilities

Logic-less {{mustache}} templates with JavaScript

Direct Vulnerabilities

Known vulnerabilities in the mustache package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Content Injection due to quoteless attributes

When using attributes without quotes in a mustache template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the mustache template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

<2.2.1
  • M
Content Injection due to quoteless attributes

When using attributes without quotes in a mustache template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the mustache template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

<2.2.1
  • M
Cross-site Scripting (XSS)

mustache is an implementation of the mustache template system in JavaScript.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks due to an escaping problem within the to_html function.

<0.4.0