CVE-2025-23026: jte's HTML templates containing Javascript template strings are subject to XSS

January 13, 2025

Jte HTML templates with script tags or script attributes that include a Javascript template string (backticks) are subject to XSS.

References

github.com/advisories/GHSA-vh22-6c6h-rm8q
github.com/casid/jte
github.com/casid/jte/commit/a6fb00d53c7b8dbb86de933215dbe1b9191a57f1
github.com/casid/jte/security/advisories/GHSA-vh22-6c6h-rm8q
nvd.nist.gov/vuln/detail/CVE-2025-23026

Detect and mitigate CVE-2025-23026 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →