ADVISORIES
- OSVDB-131671
- Vendor Advisory
GEM
PATCHED VERSIONS
- >= 2.0.3
DESCRIPTION
The upstream ‘mustache.js’ node.js module was found to not properly escape backtick (`) and equals (=) characters, leading to possible content injection via attributes in templates.
Example:
- Template: <a href={{foo}}/>
- Input: { ‘foo’ : ‘test.com onload=alert(1)’}
- Rendered result: <a href=test.com onload=alert(1)/>