GHSA-f52g-6jhx-586p

Source

https://github.com/advisories/GHSA-f52g-6jhx-586p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-f52g-6jhx-586p/GHSA-f52g-6jhx-586p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f52g-6jhx-586p

Published

2020-09-03T23:20:12Z

Modified

2020-08-31T18:54:21Z

Summary

Denial of Service in handlebars

Details

Affected versions of handlebars are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.

Recommendation

Upgrade to version 4.4.5 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:54:21Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

https://www.npmjs.com/advisories/1300

Affected packages

npm / handlebars

Package

Name: handlebars; View open source insights on deps.dev
Purl: pkg:npm/handlebars

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Fixed

4.4.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-f52g-6jhx-586p/GHSA-f52g-6jhx-586p.json"