CVE-2021-23784: Tempura Project Tempura

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.

Affected products

• Tempura Project Tempura: before 0.4.0 (fixed in 0.4.0)

Published 2021-11-03. Last modified 2026-06-17.