layui HTML Attribute cross site scripting
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00534 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed layui (npm): 2.8.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | layui | v2.8.0-rc.0; v2.8.0-rc.1; v2.8.0-rc.2; v2.8.0-rc.3; v2.8.0-rc.4; v2.8.0-rc.5; v2.8.0-rc.6; v2.8.0-rc.7; v2.8.0-rc.8; v2.8.0-rc.9; v2.8.0-rc.10; v2.8.0-rc.11; v2.8.0-rc.12; v2.8.0-rc.13; v2.8.0-rc.14; v2.8.0-rc.15; v2.8.0-rc.16 | — | No fix listed | CNA |
| — | layui (npm) | before 2.8.0 | 2.8.0 | Patch available | GHSA-hx4h-676r-j3qp |
- layui Vendor— Affected v2.8.0-rc.0; v2.8.0-rc.1; v2.8.0-rc.2; v2.8.0-rc.3; v2.8.0-rc.4; v2.8.0-rc.5; v2.8.0-rc.6; v2.8.0-rc.7; v2.8.0-rc.8; v2.8.0-rc.9; v2.8.0-rc.10; v2.8.0-rc.11; v2.8.0-rc.12; v2.8.0-rc.13; v2.8.0-rc.14; v2.8.0-rc.15; v2.8.0-rc.16 Fixed in — No fix listed CNA
- layui (npm) Vendor— Affected before 2.8.0 Fixed in 2.8.0 Patch available GHSA-hx4h-676r-j3qp
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:layui:layui:*:*:*:*:*:*:*:* | before 2.8.0 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:beta1:*:*:*:*:*:* | 2.8.0 beta1 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:beta2:*:*:*:*:*:* | 2.8.0 beta2 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:beta3:*:*:*:*:*:* | 2.8.0 beta3 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc1:*:*:*:*:*:* | 2.8.0 rc1 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc10:*:*:*:*:*:* | 2.8.0 rc10 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc11:*:*:*:*:*:* | 2.8.0 rc11 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc12:*:*:*:*:*:* | 2.8.0 rc12 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc13:*:*:*:*:*:* | 2.8.0 rc13 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc14:*:*:*:*:*:* | 2.8.0 rc14 | Vulnerable | layui |
- cpe:2.3:a:layui:layui:*:*:*:*:*:*:*:* Versions before 2.8.0 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:beta1:*:*:*:*:*:* Versions 2.8.0 beta1 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:beta2:*:*:*:*:*:* Versions 2.8.0 beta2 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:beta3:*:*:*:*:*:* Versions 2.8.0 beta3 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc1:*:*:*:*:*:* Versions 2.8.0 rc1 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc10:*:*:*:*:*:* Versions 2.8.0 rc10 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc11:*:*:*:*:*:* Versions 2.8.0 rc11 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc12:*:*:*:*:*:* Versions 2.8.0 rc12 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc13:*:*:*:*:*:* Versions 2.8.0 rc13 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc14:*:*:*:*:*:* Versions 2.8.0 rc14 Vulnerable ·layui
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:layui:layui:2.8.0:rc15:*:*:*:*:*:* | 2.8.0 rc15 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc16:*:*:*:*:*:* | 2.8.0 rc16 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc2:*:*:*:*:*:* | 2.8.0 rc2 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc3:*:*:*:*:*:* | 2.8.0 rc3 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc4:*:*:*:*:*:* | 2.8.0 rc4 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc5:*:*:*:*:*:* | 2.8.0 rc5 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc6:*:*:*:*:*:* | 2.8.0 rc6 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc7:*:*:*:*:*:* | 2.8.0 rc7 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc8:*:*:*:*:*:* | 2.8.0 rc8 | Vulnerable | layui |
| cpe:2.3:a:layui:layui:2.8.0:rc9:*:*:*:*:*:* | 2.8.0 rc9 | Vulnerable | layui |
- cpe:2.3:a:layui:layui:2.8.0:rc15:*:*:*:*:*:* Versions 2.8.0 rc15 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc16:*:*:*:*:*:* Versions 2.8.0 rc16 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc2:*:*:*:*:*:* Versions 2.8.0 rc2 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc3:*:*:*:*:*:* Versions 2.8.0 rc3 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc4:*:*:*:*:*:* Versions 2.8.0 rc4 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc5:*:*:*:*:*:* Versions 2.8.0 rc5 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc6:*:*:*:*:*:* Versions 2.8.0 rc6 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc7:*:*:*:*:*:* Versions 2.8.0 rc7 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc8:*:*:*:*:*:* Versions 2.8.0 rc8 Vulnerable ·layui
- cpe:2.3:a:layui:layui:2.8.0:rc9:*:*:*:*:*:* Versions 2.8.0 rc9 Vulnerable ·layui
Remediation
- Fix · GHSA-hx4h-676r-j3qp layui (npm) Fixed in 2.8.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3691
- 2026-10-03 Alias added: GHSA-hx4h-676r-j3qp
References
More Layui vulnerabilities
- TI-2024-31457 DOM Clobbering gadgets found in layui that lead to Cross-site Scripting CVSS 3.1MEDIUM 6.4
- TI-2023-27620 layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2023-3691 · CVE Program
- CVE-2023-3691 · NVD
- FIRST EPSS
- GHSA-hx4h-676r-j3qp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences