Advisories for Npm/Mustache package

2017

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

2014

XSS vulnerability due to improper value escaping

The library does not properly escape attribute values making XSS exploits possible.