# CVE-2023-50550: Layui cross-site scripting in table template rendering

Source: https://junglewise.ai/threats/cve-2023-50550-layui-cross-site-scripting-in-table-template-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-12-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-50550 · Severity: low · CVSS 3.1 · Published 2023-12-30

Layui is a JavaScript UI framework used to build web interfaces and data tables. A cross-site scripting (XSS) vulnerability in versions up to 2.74 allows attackers to inject malicious JavaScript through the table template data-content parameter, potentially stealing user sessions, credentials, or sensitive data displayed in the application.

Technologies: [layui (npm)](https://junglewise.ai/threats/technologies/layui). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-50550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-50550 being exploited in the wild.

**How severe is CVE-2023-50550?** Low severity, with a CVSS score of 3.1, published 30 December 2023.

**Which products and versions are affected?** layui (npm) SEMVER:introduced=0,fixed=2.7.5.

**Is there a fix for CVE-2023-50550?** Yes. layui (npm): upgrade to 2.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-50550 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-50550?** Check whether you run layui (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- layui (npm): upgrade to 2.7.5 or later

  ```sh
  npm install layui@2.7.5
  ```


## Technical details

Layui versions up to 2.74 contain a stored XSS vulnerability (CWE-79) in the table rendering component. The vulnerability exists in the data-content parameter handling when custom templates are used; user-supplied input is concatenated directly into HTML attributes without proper sanitization or escaping. An attacker can craft malicious table column templates containing JavaScript payloads that execute in the context of other users' browsers. The attack requires knowledge of the application's table configuration but does not require authentication. The vulnerability was fixed in version 2.7.5.

## Affected products

- Layui layui up to 2.74

## Identifiers

- CVE-2023-50550
- GHSA-rcvr-8whx-3m5p

## Timeline

- 2023-12-30: disclosed
- 2023-12-30: patched: Fixed in version 2.7.5

## References

- [https://gitee.com/layui/layui/issues/I8M1C2](https://gitee.com/layui/layui/issues/I8M1C2)

## Related threats

- [Layui DOM Clobbering leading to Cross-site Scripting](https://junglewise.ai/threats/cve-2024-47075-layui-dom-clobbering-leading-to-cross-site-scripting)
- [Layui cross-site scripting in title attribute rendering](https://junglewise.ai/threats/cve-2023-3691-layui-cross-site-scripting-in-title-attribute-rendering)