Cross-Site Scripting in mustache (GHSA-w3w8-37jv-2c58)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-8862
Severity: HIGH · CWE: CWE-79

Versions of `mustache` prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.



### Example
Template:
```<a href={{foo}}/>```

Input:
```{ 'foo' : 'test.com onload=alert(1)'}```

Rendered result:
```<a href=test.com onload=alert(1)/>```


## Recommendation

Update to version 2.2.1 or later.
Alternatively, ensure that all attributes in hmustache templates are encapsulated with quotes.

Affected packages:
package: ecosystem: npm
name: mustache
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.1