Update dependency nunjucks to v3.2.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nunjucks	3.2.3 → 3.2.4

---

Nunjucks autoescape bypass leads to cross site scripting

CVE-2023-2142 / GHSA-x77j-w7wf-fjmw

More information

Details

Impact

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

Example

If the user-controlled parameters were used in the views similar to the following:

<script>
let testObject = { lang: '', place: '' };
</script>

It is possible to inject XSS payload using the below parameters:

https://<application-url>/?lang=jp\&place=};alert(document.domain)//

Patches

The issue was patched in version 3.2.4.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1825980

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw
• https://github.com/mozilla/nunjucks/pull/1437
• https://github.com/mozilla/nunjucks/commit/ec16d210e7e13f862eccdb0bc9af9f60ff6749d6
• https://bugzilla.mozilla.org/show_bug.cgi?id=1825980
• https://github.com/mozilla/nunjucks/releases/tag/v3.2.4
• https://nvd.nist.gov/vuln/detail/CVE-2023-2142
• https://github.com/advisories/GHSA-x77j-w7wf-fjmw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mozilla/nunjucks (nunjucks)

v3.2.4

Compare Source

• HTML encode backslashes when expressions are passed through the escape
  filter (including when this is done automatically with autoescape). Merge
  of #​1437.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.