CVE-2023-1767

The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.

• CWE-79
• CWE-79

• https://support.snyk.io/hc/en-us/articles/10146704933405Vendor Advisory
• https://weizman.github.io/2023/04/10/snyk-xss/Exploit, Third Party Advisory
• https://support.snyk.io/hc/en-us/articles/10146704933405Vendor Advisory
• https://weizman.github.io/2023/04/10/snyk-xss/Exploit, Third Party Advisory

Published

Apr 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1761Cross-site Scripting in GitHub repository thorsten/phpmyfaq …5.4
• CVE-2023-1762Improper Privilege Management in GitHub repository thorsten/…8.8
• CVE-2023-1763Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: O…6.5
• CVE-2023-1764Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: O…6.5
• CVE-2023-1765Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-1766Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2023-1768Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25,…5.3
• CVE-2023-1769A vulnerability, which was classified as problematic, was fo…7.5
• CVE-2023-1770A vulnerability has been found in SourceCodester Grade Point…9.8
• CVE-2023-1771A vulnerability was found in SourceCodester Grade Point Aver…6.1
• CVE-2023-1772A vulnerability was found in DataGear up to 4.5.1. It has be…4.8
• CVE-2023-1773A vulnerability was found in Rockoa 2.3.2. It has been decla…9.8