CVE-2023-33187

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `type="password"` inputs. A customer may assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0. This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type="password"` continues to be obfuscated.

• CWE-319
• CWE-319

• https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mccVendor Advisory
• https://github.com/rrweb-io/rrweb/pull/1184Issue Tracking, Patch
• https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mccVendor Advisory
• https://github.com/rrweb-io/rrweb/pull/1184Issue Tracking, Patch

Published

May 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33181Xibo is a content management system (CMS). Starting in versi…5.3
• CVE-2023-33182Contacts app for Nextcloud easily syncs contacts from variou…4.3
• CVE-2023-33183Calendar app for Nextcloud easily sync events from various d…4.3
• CVE-2023-33184Nextcloud Mail is a mail app in Nextcloud. A blind SSRF atta…5.3
• CVE-2023-33185Django-SES is a drop-in mail backend for Django. The django_…5.4
• CVE-2023-33186Zulip is an open-source team collaboration tool with unique …6.1
• CVE-2023-33188Omni-notes is an open source note-taking application for And…5.5
• CVE-2023-33189Pomerium is an identity and context-aware access proxy. With…9.8
• CVE-2023-3319Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-33190Sealos is an open source cloud operating system distribution…9.8
• CVE-2023-33191Kyverno is a policy engine designed for Kubernetes. Kyverno …8.8
• CVE-2023-33192ntpd-rs is an NTP implementation written in Rust. ntpd-rs do…7.5