GitHub Advisoryadvisory · npm

GHSA-3cqr-58rm-57f8 Arbitrary Code Execution in Handlebars

HIGH Published 2022-02-10 Modified 2021-04-22 Official page ↗
Aliases
CVE-2019-20920
Ecosystem
npm
Packages
handlebars
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-94
Reviewed
2021-04-22

Affected packages

• npm handlebars: < 3.0.8 → fixed in 3.0.8 • npm handlebars: >= 4.0.0, < 4.5.3 → fixed in 4.5.3

Description

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Related

Alias · CVE (1)

  • CVE-2019-20920 Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References