CVE-2021-23784: Cross-site Scripting in tempura
Summary
CVE-2021-23784: Cross-site Scripting in tempura. Affects tempura versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tempura is an npm package used for templating in JavaScript applications. It provides a simple and efficient way to render dynamic content. However, versions of tempura before 0.4.0 are vulnerable to a Cross-Site Scripting (XSS) attack. This vulnerability occurs when the input to the 'esc' function is an object (such as an array) and is returned without being properly escaped or sanitized. As a result, an attacker can inject malicious scripts into the rendered output, potentially leading to unauthorized access or data theft.
Vulnerability Detail
The vulnerability in tempura arises from the mishandling of object inputs in the 'esc' function. When an object is passed as input, it is not properly escaped or sanitized, allowing for the execution of arbitrary JavaScript code. This can enable an attacker to inject malicious scripts into the rendered output, which may be executed by unsuspecting users visiting the affected application. The impact of this vulnerability can range from defacement of web pages to the theft of sensitive user information.
How To Fix
Latest published version: 1.0.0 as of 23 Oct 2026
npm install tempura@1.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
npm install tempura@0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of tempura is not immediately feasible, a temporary workaround can be implemented by manually escaping or sanitizing object inputs before passing them to the 'esc' function. This can be done using appropriate sanitization libraries or custom code. However, it is strongly recommended to upgrade to the fixed version of tempura as soon as possible to ensure comprehensive protection against XSS attacks.
Conclusion
The Cross-Site Scripting vulnerability in tempura versions prior to 0.4.0 can allow attackers to inject malicious scripts into the rendered output of applications. To mitigate this risk, it is recommended to upgrade to the latest version of tempura (0.4.0 or later) or apply appropriate sanitization measures to object inputs. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tempura →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate website content, or perform other unauthorized actions.
The tempura vulnerability allows attackers to inject malicious scripts into the rendered output of applications using vulnerable versions of the package. This can lead to various consequences, including defacement of web pages, theft of sensitive user information, and unauthorized access to user accounts.
Yes, this vulnerability can be exploited remotely. An attacker can craft malicious input and send it to a vulnerable application, which will then render the injected script when viewed by other users.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to promptly address and fix vulnerabilities to minimize the risk of exploitation.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level. It is important to address this vulnerability promptly to mitigate the risk of exploitation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
