GHSA-q765-wm9j-66qj

Source

https://github.com/advisories/GHSA-q765-wm9j-66qj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-q765-wm9j-66qj/GHSA-q765-wm9j-66qj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q765-wm9j-66qj

Aliases

CVE-2024-45390

Published

2024-09-03T19:42:25Z

Modified

2024-11-18T16:27:09Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

@blakeembrey/template vulnerable to code injection when attacker controls template input

Details

Impact

It is possible to inject and run code within the template if the attacker has access to write the template name.

const { template } = require('@blakeembrey/template');

template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned");

Patches

Upgrade to 1.2.0.

Workarounds

Don't pass untrusted input as the template display name, or don't use the display name feature.

References

Fixed by removing in https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-09-03T19:42:25Z",
    "nvd_published_at":  "2024-09-03T20:15:08Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / @blakeembrey/template

Package

Name: @blakeembrey/template; View open source insights on deps.dev
Purl: pkg:npm/%40blakeembrey/template

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-q765-wm9j-66qj/GHSA-q765-wm9j-66qj.json"