GitHub Advisoryadvisory · npm
GHSA-q765-wm9j-66qj @blakeembrey/template vulnerable to code injection when attacker controls template input
MEDIUM
Official page ↗
- Aliases
- CVE-2024-45390
- Ecosystem
- npm
- Packages
- @blakeembrey/template
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-94
- Reviewed
- 2024-09-03
Affected packages
• npm @blakeembrey/template: < 1.2.0 → fixed in 1.2.0
Description
Impact
It is possible to inject and run code within the template if the attacker has access to write the template name.
```js
const { template } = require('@blakeembrey/template');
template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned");
```
Patches
Upgrade to 1.2.0.
Workarounds
Don't pass untrusted input as the template display name, or don't use the display name feature.
References
Fixed by removing in https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa.
Related
Alias · CVE (1)
- CVE-2024-45390 @blakeembrey/template is a string template library. vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness