GHSA-3cqr-58rm-57f8
Arbitrary Code Execution in Handlebars
At a glance
- Published
- Updated
- CVE
- CVE-2019-20920
- Aliases
- SNYK-JS-HANDLEBARS-534478
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Description
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Affected packages
| Package | Versions |
|---|---|
| npm · handlebars | introduced 0, fixed 3.0.8 |
| npm · handlebars | introduced 4.0.0, fixed 4.5.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-20920 ADVISORY
- https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee WEB
- https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e WEB
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478 WEB
- https://www.npmjs.com/advisories/1316 WEB
- https://www.npmjs.com/advisories/1324 WEB
- https://www.npmjs.com/package/handlebars WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |