GHSA-q42p-pg8m-cqh6

Source

https://github.com/advisories/GHSA-q42p-pg8m-cqh6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-q42p-pg8m-cqh6/GHSA-q42p-pg8m-cqh6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q42p-pg8m-cqh6

Related

Published

2019-06-05T14:07:48Z

Modified

2021-08-04T20:54:05Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Prototype Pollution in handlebars

Details

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Recommendation

For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-471"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-05T13:55:39Z"
}

References

Affected packages

npm / handlebars

Package

Name: handlebars; View open source insights on deps.dev
Purl: pkg:npm/handlebars

Affected ranges

Type: SEMVER
Events: Introduced

4.1.0

Fixed

4.1.2

Ecosystem specific

{
    "affected_functions": [
        "(handlebars).helpers.lookup"
    ]
}

npm / handlebars

Package

Name: handlebars; View open source insights on deps.dev
Purl: pkg:npm/handlebars

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Fixed

4.0.14

Ecosystem specific

{
    "affected_functions": [
        "(handlebars).helpers.lookup"
    ]
}

npm / handlebars

Package

Name: handlebars; View open source insights on deps.dev
Purl: pkg:npm/handlebars

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.7

Ecosystem specific

{
    "affected_functions": [
        "(handlebars).helpers.lookup"
    ]
}