CVE-2016-10547

Vulnerability

A bypass of autoescape mode exists in Nunjucks versions 2.4.2 and earlier [1][3]. The suppressValue function in src/runtime.js only escapes template variables if they are of type string [2][4]. When a variable is passed as an array (e.g., via an HTTP query string using [] notation), the type check fails and the value is rendered unescaped, allowing cross-site scripting (XSS) injection [1][2].

Exploitation

An attacker can inject arbitrary HTML or JavaScript into a page by supplying a query parameter using array syntax, such as ?name[]= [2]. This works because frameworks like Express use qs or body-parser to parse query strings, which automatically produce arrays when [] is used [2][4]. The attacker needs no authentication; only the ability to craft a URL that a victim visits on a server using Nunjucks with autoescape enabled [2].

Impact

Successful exploitation results in reflected XSS, allowing the attacker to execute arbitrary JavaScript in the victim's browser within the context of the vulnerable application. This can lead to session hijacking, credential theft, defacement, or other client-side attacks [1].

Mitigation

Fix released in Nunjucks version 2.4.3 [3]. Upgrade to 2.4.3 or later immediately. No workaround is available if autoescape is required. If upgrading is not possible, ensure user input is not passed as an array to templates (e.g., by converting arrays to strings before rendering) [2][4]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.