What’s Vulnerable › Vulnerabilities

CVE-2023-1767

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-20 · updated 2026-06-17
• Weakness: CWE-79

Description

The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.

Affected products

• Snyk Advisor: before 2023-03-28 — fixed in 2023-03-28

How to fix

Upgrade to a fixed version: Snyk Advisor 2023-03-28. Check the vendor advisory for mitigations.

References

• https://support.snyk.io/hc/en-us/articles/10146704933405
• https://weizman.github.io/2023/04/10/snyk-xss/
• https://support.snyk.io/hc/en-us/articles/10146704933405
• https://weizman.github.io/2023/04/10/snyk-xss/

Get alerted when CVE-2023-1767 or the next vulnerability affects your stack