GHSA-w457-6q6x-cgp9

Suggest an improvement
Source
https://github.com/advisories/GHSA-w457-6q6x-cgp9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-w457-6q6x-cgp9/GHSA-w457-6q6x-cgp9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w457-6q6x-cgp9
Aliases
Related
Published
2019-12-26T17:58:13Z
Modified
2024-02-16T08:18:27.373362Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Prototype Pollution in handlebars
Details

Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Recommendation

Upgrade to version 3.0.8, 4.3.0 or later.

Database specific
{
    "nvd_published_at": "2019-12-20T23:15:00Z",
    "cwe_ids": [
        "CWE-1321",
        "CWE-74"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2019-12-26T17:55:40Z"
}
References

Affected packages

npm / handlebars

Package

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.3.0

Ecosystem specific

{
    "affected_functions": [
        "(handlebars).compile"
    ]
}

RubyGems / bootstrap-wysihtml5-rails

Package

Name
bootstrap-wysihtml5-rails
Purl
pkg:gem/bootstrap-wysihtml5-rails

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.3.3.5
Last affected
0.3.3.8

Affected versions

0.*

0.3.3.5
0.3.3.6
0.3.3.7
0.3.3.8

npm / handlebars

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.8

Ecosystem specific

{
    "affected_functions": [
        "(handlebars).compile"
    ]
}