GHSA-5f38-9jw2-6r6hMediumCVSS 5.4

Cross-site Scripting in teddy

Published
October 12, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-23447 →

📋 Description

Teddy is a readable and easy to learn templating language. This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).

🎯 Affected products1

  • npm/teddy:< 0.5.9

🔗 References (6)