This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: snyk
Published: 2022-01-13T14:10:20.047966Z
Updated: 2024-09-16T23:55:47.509Z
Reserved: 2021-01-08T00:00:00
Link: CVE-2021-23824
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-01-13T15:15:07.867
Modified: 2024-11-21T05:51:54.143
Link: CVE-2021-23824
Redhat
No data.