CVE-2023-2142 — In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality

Matched remediation archetype

Cross-site scripting and unsafe browser output

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Trace reflected, stored, and DOM-derived untrusted values into HTML, attributes, URLs, styles, scripts, and client-side template sinks.
• Identify affected origins, authenticated user roles, sensitive browser capabilities, and where content is shared across tenants.
• Review framework escaping, rich-text sanitization, legacy templates, and client-side rendering paths.

Remediate safely

• Use context-aware framework output encoding and safe DOM APIs; keep untrusted data out of executable contexts.
• Sanitize intentionally supported markup with a maintained allowlist policy and validate URLs and attributes separately.
• Update affected rendering components and add tests for every output context using inert sentinel markup.