PT-2021-15528 · Npm · Edge.Js

Alessio Della Libera · Published 2021-09-21 · Updated 2022-05-03 · CVE-2021-23443

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions edge.js versions prior to 5.3.2

Description A type confusion issue can be exploited to bypass input sanitization when the input to be rendered is an array, even if {{ }} are used. This affects the edge.js package, which is a template engine for Node.js.

Recommendations For versions prior to 5.3.2, update to version 5.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the input to be rendered to strings or SafeValues to minimize the risk of exploitation.

Exploit

Fix

Type Confusion

XSS

Weakness Enumeration

CWE-843

CWE-79

Related Identifiers

CVE-2021-23443

GHSA-55R9-7MF8-M382

SNYK-JS-EDGEJS-1579556

Affected Products

Edge.Js

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556 · Exploit
• https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23443 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23443 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55r9-7mf8-m382 · Vendor Advisory
• https://github.com/edge-js/edge · Note
• https://t.me/cibsecurity/29193 · Telegram Post