Cross-Site Scripting (XSS) Vulnerability in mustache
Summary
GHSA-3233-rgx3-c2wh: Moderate severity vulnerability that affects mustache. Affects mustache versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mustache is an npm package used for logic-less templates. It allows developers to separate the presentation layer from the data in their applications. The package provides a simple and lightweight templating engine that can be used in various programming languages. However, versions before 2.2.1 for Node.js are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in mustache arises from a lack of proper attribute quoting in templates. An attacker can exploit this by crafting a malicious template with an unquoted attribute, which can lead to the execution of arbitrary JavaScript code in the context of the victim's browser. This can result in various security issues, such as session hijacking, data theft, or the injection of malicious content.
How To Fix
Latest published version: 4.2.0 as of 22 Oct 2026
npm install mustache@4.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
npm install mustache@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, developers can mitigate the risk by manually quoting all attributes in their templates. This can be done by adding double quotes around attribute values in the template code. For example, instead of {{name}}, use {{"name"}}. However, it is strongly recommended to update to the latest version as soon as possible.
Conclusion
The cross-site scripting (XSS) vulnerability in mustache versions prior to 2.2.1 for Node.js can have serious security implications. It is crucial for developers to update their mustache package to the latest version or manually quote attributes in their templates to prevent exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mustache →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the victim's browser, compromising their data and potentially enabling further attacks.
The vulnerability affects mustache versions prior to 2.2.1 for Node.js. It allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an unquoted attribute. This can lead to the execution of arbitrary JavaScript code in the victim's browser.
Exploiting this vulnerability can have various consequences, including session hijacking, data theft, and the injection of malicious content. Attackers can use the XSS vulnerability to steal sensitive information, manipulate the appearance of web pages, or perform actions on behalf of the victim.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this XSS vulnerability in mustache.
If updating to mustache version 2.2.1 or higher is not immediately feasible, you can manually quote all attributes in your templates to mitigate the risk. This involves adding double quotes around attribute values in the template code. However, it is strongly recommended to update to the latest version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for mustache.
