CVE-2021-23784

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.

• CWE-79

• https://github.com/lukeed/tempura/commit/58a5c3671e2f36b26810e77ead9e0dd471902f9bPatch, Third Party Advisory
• https://github.com/lukeed/tempura/releases/tag/v0.4.0Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TEMPURA-1569633Exploit, Mitigation, Patch, Third Party Advisory, VDB Entry
• https://github.com/lukeed/tempura/commit/58a5c3671e2f36b26810e77ead9e0dd471902f9bPatch, Third Party Advisory
• https://github.com/lukeed/tempura/releases/tag/v0.4.0Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TEMPURA-1569633Exploit, Mitigation, Patch, Third Party Advisory, VDB Entry

Published

Nov 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2376Vulnerability in the Oracle WebLogic Server product of Oracl…7.5
• CVE-2021-23760The package keyget from 0.0.0 are vulnerable to Prototype Po…9.8
• CVE-2021-2377Vulnerability in the PeopleSoft Enterprise PeopleTools produ…4.3
• CVE-2021-23771This affects all versions of package notevil; all versions o…6.5
• CVE-2021-23772This affects all versions of package github.com/kataras/iris…8.8
• CVE-2021-2378Vulnerability in the Oracle WebLogic Server product of Oracl…7.5
• CVE-2021-23792The package com.twelvemonkeys.imageio:imageio-metadata befor…9.8
• CVE-2021-23797All versions of package http-server-node are vulnerable to D…9.8
• CVE-2021-2380Vulnerability in the Oracle Applications Framework product o…7.6
• CVE-2021-23803This affects the package latte/latte before 2.10.6. There is…9.8
• CVE-2021-23807This affects the package jsonpointer before 5.0.0. A type co…9.8
• CVE-2021-2381Vulnerability in the Oracle Solaris product of Oracle System…3.9