Cross-site Scripting (XSS)

Vulnerability

All versions of the package curly-bracket-parser are vulnerable to Cross-site Scripting (XSS). When used as a template library, it does not properly sanitize user input supplied to template variables, such as {{name}} [1][2][3].

Exploitation

An attacker can inject arbitrary JavaScript by providing a crafted value for a template variable, for example via a URL query parameter like ?name=. The parser processes the template and returns the unsanitized string to the browser, which then executes the injected script [2].

Impact

Successful exploitation leads to reflected XSS, allowing the attacker to execute arbitrary JavaScript in the victim's browser. This can result in session hijacking, defacement, or theft of sensitive data.

Mitigation

As of the publication date (July 2021), there is no fixed version available for curly-bracket-parser [2]. Users should avoid using the package in contexts where user input is processed, or manually sanitize output with a dedicated sanitization library.