GHSA-g9r4-xpmj-mj65

Suggest an improvement
Source
https://github.com/advisories/GHSA-g9r4-xpmj-mj65
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g9r4-xpmj-mj65/GHSA-g9r4-xpmj-mj65.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g9r4-xpmj-mj65
Downstream
CGA (152)
CLSA (6)
MINI (1)
Published
2020-09-04T15:06:32Z
Modified
2026-09-10T03:49:13Z
Summary
Prototype Pollution in handlebars
Details

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

Database specific 
{
    "cwe_ids":  [
        "CWE-1321"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:55:14Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / handlebars

Package

Name
handlebars
View open source insights on deps.dev
Purl
pkg:npm/handlebars

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g9r4-xpmj-mj65/GHSA-g9r4-xpmj-mj65.json"

npm / handlebars

Package

Name
handlebars
View open source insights on deps.dev
Purl
pkg:npm/handlebars

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.5.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g9r4-xpmj-mj65/GHSA-g9r4-xpmj-mj65.json"