Issues

• Security: Path Traversal in FileSystemLoader via prefix-check bypass (getSource)

  11ty/nunjucks#20 · Filter by author iaohkut-from-NightWolf-Team opened on Aug 25, 2026

• Security: Uncontrolled Resource Consumption via unbounded width in center()/indent() filters (repeat()) — indefinite event-loop hang

  11ty/nunjucks#19 · Filter by author iaohkut-from-NightWolf-Team opened on Aug 25, 2026

• Security: Incomplete tag stripping in striptags filter enables attribute-breakout XSS when combined with |safe

  11ty/nunjucks#18 · Filter by author iaohkut-from-NightWolf-Team opened on Aug 25, 2026

• Security: Stored/Reflected XSS via urlize filter HTML attribute injection

  11ty/nunjucks#17 · Filter by author iaohkut-from-NightWolf-Team opened on Aug 25, 2026

• Security: Prototype Pollution in render Context via lib.extend() enables arbitrary template-variable injection

  11ty/nunjucks#16 · Filter by author iaohkut-from-NightWolf-Team opened on Aug 25, 2026

• Implement an "error tolerant parser"

  11ty/nunjucks#13 · Filter by author KonnorRogers opened on Jun 30, 2026

• Get rid of separate browser bundle

  Task

  11ty/nunjucks#12 · Filter by author zachleat opened on Jun 29, 2026

• Get rid of built src directory

  Task

  11ty/nunjucks#11 · Filter by author zachleat opened on Jun 29, 2026

• Eligible Upstream PR: Add with keyword for include

  Enhancement

  11ty/nunjucks#9 · Filter by author zachleat opened on Jun 26, 2026

• Eligible Upstream PR: Add support for Set

  Enhancement

  11ty/nunjucks#8 · Filter by author zachleat opened on Jun 26, 2026