GHSA-765h-qjxv-5f44

Source

https://github.com/advisories/GHSA-765h-qjxv-5f44

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-765h-qjxv-5f44/GHSA-765h-qjxv-5f44.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-765h-qjxv-5f44

Aliases

CVE-2021-23383
SNYK-JAVA-ORGWEBJARS-1279031
SNYK-JAVA-ORGWEBJARSBOWER-1279032
SNYK-JAVA-ORGWEBJARSNPM-1279030
SNYK-JS-HANDLEBARS-1279029

Related

Published

2022-02-10T23:51:42Z

Modified

2024-08-01T07:13:08.522446Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Prototype Pollution in handlebars

Details

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Database specific

{
    "nvd_published_at": "2021-05-04T09:15:00Z",
    "cwe_ids": [
        "CWE-1321"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-19T21:17:59Z"
}

References

Affected packages

npm / handlebars

Package

Name: handlebars; View open source insights on deps.dev
Purl: pkg:npm/handlebars

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.7.7

Ecosystem specific

{
    "affected_functions": [
        "(handlebars).compile"
    ]
}