VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jan 23, 2017· Updated May 13, 2026

CVE-2015-8862

CVE-2015-8862

Description

mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mustachenpm
< 2.2.12.2.1

Affected products

1

Patches

1
378bcca8a5cf

Improve HTML escaping.

https://github.com/janl/mustache.jsPhillip JohnsenNov 17, 2015via ghsa
commit
3 files changed · +6 −4
  • mustache.js+4 −2 modified
    @@ -63,11 +63,13 @@
     '>': '&gt;',
     '"': '&quot;',
     "'": '&#39;',
-    '/': '&#x2F;'
+    '/': '&#x2F;',
+    '`': '&#x60;',
+    '=': '&#x3D;'
   };
 
   function escapeHtml (string) {
-    return String(string).replace(/[&<>"'\/]/g, function fromEntityMap (s) {
+    return String(string).replace(/[&<>"'`=\/]/g, function fromEntityMap (s) {
       return entityMap[s];
     });
   }
  • test/_files/escaped.js+1 −1 modified
    @@ -2,5 +2,5 @@
   title: function () {
     return "Bear > Shark";
   },
-  entities: "&quot; \"'<>/"
+  entities: "&quot; \"'<>`=/"
 })
  • test/_files/escaped.txt+1 −1 modified
    @@ -1,2 +1,2 @@
 <h1>Bear &gt; Shark</h1>
-And even &amp;quot; &quot;&#39;&lt;&gt;&#x2F;, but not &quot; "'<>/.
+And even &amp;quot; &quot;&#39;&lt;&gt;&#x60;&#x3D;&#x2F;, but not &quot; "'<>`=/.

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.