GitHub Advisoryadvisory · npm

GHSA-q42p-pg8m-cqh6 Prototype Pollution in handlebars

HIGH Published 2019-06-05 Modified 2021-08-04 Official page ↗
Ecosystem
npm
Packages
handlebars
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-471
Reviewed
2019-06-05

Affected packages

• npm handlebars: >= 4.1.0, < 4.1.2 → fixed in 4.1.2 • npm handlebars: >= 4.0.0, < 4.0.14 → fixed in 4.0.14 • npm handlebars: < 3.0.7 → fixed in 3.0.7

Description

Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.

Related

Weakness · CWE (1)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References