GHSA-g9r4-xpmj-mj65

Source

https://github.com/advisories/GHSA-g9r4-xpmj-mj65

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-g9r4-xpmj-mj65/GHSA-g9r4-xpmj-mj65.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g9r4-xpmj-mj65

Related

Published

2020-09-04T15:06:32Z

Modified

2020-08-31T18:55:14Z

Summary

Prototype Pollution in handlebars

Details

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-1321"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:55:14Z"
}

References

https://www.npmjs.com/advisories/1325

Affected packages

npm / handlebars

Package

Name: handlebars; View open source insights on deps.dev
Purl: pkg:npm/handlebars

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.8