# CVE-2023-3691: Layui cross-site scripting in title attribute rendering

Source: https://junglewise.ai/threats/cve-2023-3691-layui-cross-site-scripting-in-title-attribute-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-3691 · Severity: low · CVSS 3.1 · Published 2023-07-16

Layui is a popular JavaScript UI library used to build web applications. A cross-site scripting (XSS) vulnerability in the title attribute handling of checkbox components allows attackers to inject malicious scripts that execute in users' browsers, potentially compromising user sessions, stealing data, or redirecting users to malicious sites.

Technologies: [layui (npm)](https://junglewise.ai/threats/technologies/layui). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-3691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-3691 being exploited in the wild.

**How severe is CVE-2023-3691?** Low severity, with a CVSS score of 3.1, published 16 July 2023.

**Which products and versions are affected?** layui (npm) SEMVER:introduced=0,fixed=2.8.0.

**Is there a fix for CVE-2023-3691?** Yes. layui (npm): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-3691 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-3691?** Check whether you run layui (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- layui (npm): upgrade to 2.8.0 or later

  ```sh
  npm install layui@2.8.0
  ```


## Technical details

The vulnerability is a stored/reflected cross-site scripting (CWE-79) flaw in Layui's HTML Attribute Handler component. When rendering checkbox elements and other components, the title attribute parameter is not properly escaped, allowing HTML and JavaScript injection. An attacker can craft a malicious title value containing script tags or event handlers; when this is rendered on a webpage, the payload executes in the victim's browser context. The attack requires user interaction (UI:R) and network access, but no authentication. The vulnerability affects Layui versions up to v2.8.0-rc.16 and was fixed in v2.8.0 by properly escaping title attribute values.

## Affected products

- Layui layui up to v2.8.0-rc.16

## Identifiers

- CVE-2023-3691
- GHSA-hx4h-676r-j3qp

## Timeline

- 2023-07-16: disclosed
- 2023-07-16: patched: Fix available in v2.8.0

## References

- [https://gitee.com/layui/layui/issues/I7HDXZ](https://gitee.com/layui/layui/issues/I7HDXZ)

## Related threats

- [Layui DOM Clobbering leading to Cross-site Scripting](https://junglewise.ai/threats/cve-2024-47075-layui-dom-clobbering-leading-to-cross-site-scripting)
- [Layui cross-site scripting in table template rendering](https://junglewise.ai/threats/cve-2023-50550-layui-cross-site-scripting-in-table-template-rendering)