GHSA-55r9-7mf8-m382

Cross-site Scripting in edge.js

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23443

Packages

Ecosystem	Package	Affected	Fixed in
npm	edge.js	< 5.3.2	5.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Edge is a logical and batteries included template engine for Node.js. This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if `{{ }}` are used.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23443 advisory
https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21 web
https://github.com/edge-js/edge package
https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556 web