CVE-2023-1767

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Snyk	Snyk Advisor	>= 2020-10-01, < 2023-03-28

References

https://support.snyk.io/hc/en-us/articles/10146704933405Vendor Advisory
https://weizman.github.io/2023/04/10/snyk-xss/Exploit, Third Party Advisory
https://support.snyk.io/hc/en-us/articles/10146704933405Vendor Advisory
https://weizman.github.io/2023/04/10/snyk-xss/Exploit, Third Party Advisory

Timeline

Published: Apr 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-17685.3Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the sy CVE-2023-17697.5A vulnerability, which was classified as problematic, was found in SourceCodester Grade Point Average GPA Calculator 1.0. Affected is an unk CVE-2023-17709.8A vulnerability has been found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as critical. Affected by this vulnera CVE-2023-17716.1A vulnerability was found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as problematic. Affected by this issue is CVE-2023-17724.8A vulnerability was found in DataGear up to 4.5.1. It has been classified as problematic. This affects an unknown part of the component Diag CVE-2023-17739.8A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConf CVE-2023-17745.4When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allow CVE-2023-17756.5When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast t CVE-2023-17765.4Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to CVE-2023-17775.3Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosin CVE-2023-17789.8This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default creden CVE-2023-17794.3Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX2